Browser isolation
A restrictive content policy, anti-framing rules, type-sniffing prevention and limited browser permissions reduce common injection and clickjacking risks.
Book a consultation ↗Home ↗Security centre
Luxury at the front.
Rigour underneath.
Security is designed into the website journey—from a minimal-data enquiry to a carefully limited browser environment.
Review the controls ↓HTTPS enforced in productionMinimal enquiry dataNo advertising trackers
No website can guarantee that a breach will never occur. SPP uses layered controls to reduce risk, limits the information it handles and reviews the configuration before public launch.
01 / Defence in depth
Practical protection
Six controls around
every sensitive step.
The architecture is intentionally narrow: collect less, trust less, validate inputs and minimise exposure.
Encrypted transport
Production traffic is served over HTTPS so information is encrypted while travelling between the visitor and the website.
Minimal collection
The public site has no advertising trackers. Enquiries request only the information needed to assess a project.
Bounded input
Names, email addresses and project descriptions are validated and limited in length before an enquiry is accepted.
Protected enquiries
Enquiries accept only same-origin writes, bounded JSON payloads and validated fields. A hidden bot trap and best-effort abuse controls reduce automated submissions.
No advertising profile
SPP does not use third-party advertising pixels or behavioural tracking to build a profile of website visitors.
02 / Responsibility boundary
What happens where
Your browser, SPP
and the enquiry.
Visitor chooses
You decide what project information to provide and are reminded not to submit access codes, identity documents or banking details.
SPP validates
The website checks required fields, limits payload size and rejects malformed or suspicious submissions.
SPP responds
The authorised studio team reviews the project brief and replies through the official business email channel.
03 / Responsible disclosure
Found something?
Report it privately.
We will take it seriously.
Secure by design, transparent by default
Protection is a process.
Not a slogan.
The configuration will be reviewed again before the website is opened to the public.