In short
How this website is secured and how to report a vulnerability in it: transport security, content security policy, form protection, what is logged, what is never logged, and the retention applied to any sample media a visitor chooses to upload.
Reporting a vulnerability
Email infojp@ayonix.com with Security in the subject line. Include the URL, what you found, how to reproduce it, and what you were able to achieve. We will acknowledge and keep you informed; please give us a reasonable opportunity to fix it before publishing details.
Please do not use the general enquiry form for security reports — it is read by the sales and engineering team rather than routed to security.
Scope
In scope: facerec.ayonix.com and its API endpoints.
Out of scope: denial of service; social engineering of Ayonix staff; physical attacks; findings requiring a compromised device or browser; automated scanner output with no demonstrated impact; and reports about a missing header with no exploitable consequence. Reports about the Ayonix products themselves, rather than this website, should go to the same address and will be routed accordingly.
Controls
How this site is secured
Each of these is implemented rather than aspirational, and most are verifiable from outside with a request and a response header.
| Control | What it does |
|---|---|
| HTTPS with HSTS | All traffic over TLS, with Strict-Transport-Security including subdomains and preload, so a downgrade is not available even on a first visit after preloading. |
| Content Security Policy | A restrictive policy naming the specific origins scripts, styles and connections may use. frame-ancestors is set to none, which is what actually prevents clickjacking — X-Frame-Options is the legacy fallback. |
| X-Content-Type-Options | nosniff, so a response is never interpreted as a type it did not declare. |
| Permissions-Policy | Camera, microphone, geolocation, payment and USB are all denied. This is a marketing site; none of them has any business being available to it. |
| Referrer-Policy | strict-origin-when-cross-origin, so a full URL — which may carry a query parameter — is not leaked to a third-party origin. |
| Form protection | Cloudflare Turnstile, a honeypot field, a minimum elapsed-time check, per-address rate limiting, input length limits and server-side schema validation. All of them, not one of them. |
| Duplicate suppression | A client-generated submission id with a unique index, so a retry after a timeout records one enquiry rather than two. |
| Safe redirects | Only same-origin paths are followed. A protocol-relative or absolute target is replaced with the fallback. |
| Private object storage | The sample-upload bucket has no public access and no custom domain. Uploaded media is never served back over the web to anyone. |
| Enforced retention | A scheduled job deletes expired uploads hourly. A configured retention longer than seven days is clamped down to seven, never up. |
| No secrets in the client bundle | Only the Turnstile site key, which is public by design, reaches the browser. The build gate scans the output for anything secret-shaped and fails if it finds one. |
| Dependency auditing | npm audit in the pipeline, with a committed lockfile so the audited tree is the deployed tree. |
Logging
What is logged, and what never is
This site receives people’s names, email addresses and descriptions of their security estates. None of that belongs in an observability pipeline.
Logged
- The event name and its outcome
- The source page and the CTA slug
- The names of fields that failed validation
- A two-letter country code
- A coarse browser family such as “chrome” or “automated”
- Upload size, content type and retention period
- Object keys for uploads — which identify an object, not a person
Never logged
- Any form field value
- Names, email addresses or organisation names
- Message bodies
- Uploaded filenames
- Upload references or any URL that would locate media
- IP addresses
- Full user-agent strings
- Any biometric data whatsoever
The logging helper additionally redacts any value that looks like an email address or a URL, as a guard against a field value being passed to it by mistake. Analytics is subject to the same rule: it receives page views, performance timings and author-written event labels, never anything derived from what a visitor typed or uploaded.
Uploads
How sample media is handled
A camera view contains images of identifiable people who did not choose to send them to us. The handling reflects that.
Explicit, separate consent
A distinct confirmation that the uploader is authorised to share the media, separate from any contact consent, recorded with its timestamp.
Type and signature validation
Only JPEG, PNG, WebP, MP4 and MOV are accepted, and the file’s leading bytes are checked against the type it declares.
Size limits
A configurable ceiling, 25 MB by default. Files below 1 KB are rejected as empty.
Unguessable keys
A UUID plus 16 further random bytes. Not a capability — the bucket is private — but not enumerable either.
Private storage only
No public bucket, no custom domain, no signed URL. Media is never served back over the web to anyone.
Automatic deletion
Within seven days, by an hourly scheduled job. A second pass deletes anything older than the ceiling regardless of its recorded expiry.
Access logging
Creation, read, deletion and expiry each logged with the actor. “Who looked at this person’s face” is a question that will eventually be asked.
No training use
Uploaded media is never used to train any model. It is used for a technical assessment of the camera view and nothing else.
No automatic recognition
This website does not run recognition on uploaded media automatically. Assessment is a human activity performed deliberately.
To have an upload deleted before its automatic expiry, email infojp@ayonix.com quoting the reference you were given. The deletion is performed and logged.
Frequently asked questions
How do I report a vulnerability in this website?
Email infojp@ayonix.com with "Security" in the subject line. Include what you found, the URL, the steps to reproduce it and what you were able to achieve. Please do not use the general enquiry form for this, and please do not post details publicly before we have had a chance to respond.
What is in scope?
facerec.ayonix.com and its API endpoints. Out of scope: denial of service, social engineering of Ayonix staff, physical attacks, findings that require a compromised device or browser, automated scanner output with no demonstrated impact, and reports about missing headers that have no exploitable consequence.
Is the sample upload bucket publicly accessible?
No, and it must never be. The bucket has no public access and no custom domain; uploaded media is never served back over the web to anyone, including the person who uploaded it. Keys are unguessable, and the build gate fails if a public bucket URL appears anywhere in the source or output.
What does this site log?
Structured events with the outcome, the source page, the CTA and the names of any fields that failed validation — never field values. No form contents, no email addresses, no message bodies, no filenames and no upload references reach the application logs or analytics. The logging helper actively redacts anything that looks like an address or a URL.
Is my IP address stored?
No. It arrives with every request as it must, and it is used to derive a country code and a salted hash for rate limiting. Neither can be reversed. The address itself is not written to the database.