Security & when things break
Compliance
21 guides across 5 sections
Compliance10
- ADA & WCAG: web accessibility compliance in the USWhat the Americans with Disabilities Act and the Web Content Accessibility Guidelines mean for your website, and how we build with accessibility in mind.
- CCPA & CPRA basics for businesses serving CaliforniaWhat California's consumer privacy law means for your website, who it applies to, and the practical steps we take to help you align with it.
- CompliancePlain-English guides to the web-related laws and standards that affect your business, from privacy and accessibility to payment security.
- Cookie consent law: when & howWhen your website needs a cookie consent banner, what it must include, and how we set one up to follow GDPR and CCPA rules.
- GDPR basics for businessesWhat the EU's General Data Protection Regulation means for your website, even if your business is based outside Europe.
- HIPAA basics for websites handling health infoWhat HIPAA means for your website if you work in healthcare or collect health-related information, and the technical safeguards we implement.
- How to write a privacy policy that's actually trueWhat a website privacy policy has to say under California, Delaware, Nevada, CCPA and GDPR rules, where to put it, how to use a generator well, and how to keep it accurate as your site changes.
- How to write terms of service that will actually hold upWhat website terms of service are for, what to put in them, the store and subscription rules that sit alongside them, and how to present them so a court will treat them as agreed.
- PCI compliance for online storesWhat PCI DSS means for your e-commerce site, how payment processing actually works, and why the way we build stores keeps your PCI burden small.
- Why your website needs legal pages, and which onesWhich legal pages your website actually needs (privacy policy, terms of service, refund policy, cookie notice, disclaimers), which are required by law, which by the platforms you use, and the real cases that show why.
Industries5
- Health and wellness brand websitesWhat health and wellness brands (supplements, skincare, fitness, services) need from a website, including the rules on health claims, reviews and data.
- Healthcare websites & HIPAA basicsWhat healthcare providers need to know about building a trustworthy website that handles patient information responsibly.
- Non-profit websites: donations, volunteers & boardsHow non-profit organizations can build websites that drive donations, recruit volunteers, keep boards informed, and handle donor data responsibly.
- Real estate websitesWhat real estate agents, brokers, and agencies need from their website, from IDX listings to lead capture, fair housing compliance, and agent branding.
- Websites for legal & accounting practicesHow law firms and accounting practices can build websites that earn trust, generate consultations, and handle client information responsibly.
Security for your company3
- Security for your companySecurity guides for leaders responsible for a whole organization: a first security plan, SSO, device management, vendor checks, SOC 2 and incident response.
- Security questionnaires and SOC 2: what bigger clients will ask youWhat security questionnaires and SOC 2 reports are, the difference between Type I and Type II, and how a small company can answer larger clients honestly.
- Vendor and third-party risk: what to ask your software providersHow to check whether a software provider or contractor will keep your data safe, with the questions to ask and how to judge the answers.
Developer platforms2
- AWS KMS & encryption keysWhat AWS Key Management Service does, how key policies control access, why rotation matters, and why deleting a key is irreversible.
- ClamAV & scanning uploaded filesWhat ClamAV does, why applications that accept file uploads need malware scanning, and how it fits into a wider upload-security approach.