Security & Privacy

All traffic to and from this site is served over HTTPS (TLS). Data submitted through the contact form is transmitted with transport-layer encryption between your browser and our servers.

Client data is stored in a managed database with row-level security. Only authenticated staff with an explicit admin role can view contact submissions. Sensitive actions (such as deleting a submission) require typed confirmation and are written to an internal audit log.

The contact form validates input server-side, includes a honeypot for bots, and applies per-IP rate limiting so a single source cannot flood our inbox.

We collect only the details you voluntarily submit (name, email, optional phone, and your message). Data is processed to respond to your inquiry under Art. 6(1)(b) and (f) GDPR. Full details, retention periods, and your rights are described in our Datenschutzerklärung.

Transactional replies are sent from a verified sender domain (notify.jonathanlawfirm.net) with SPF, DKIM, and DMARC alignment. Every automated reply includes an unsubscribe link, and suppression is honoured on subsequent sends.

Staff accounts require email + password sign-in with breached- password screening (HIBP) enabled. Passwords known to be compromised in public breaches are rejected at sign-up and password change.