# Website Security, Data Handling & Reporting | MUJEER Source: https://mujeer.com/security # Security, with clear responsibilities. Practical protections for this website. Defined requirements for your project. A clear contact when something needs attention. 01 / This website ## Practical controls. A defined scope. The controls below describe this company website. Product and client systems need their own assessment against their data, users and deployment requirements. ### Protected connections HTTPS protects information in transit. Browser policies restrict resource loading, prevent framing and reduce exposure to untrusted content. These protections apply to this company website. ### Validated enquiries The server checks enquiry fields, request size, form session and request origin. CSRF protection, abuse limits and server-verified Google reCAPTCHA help reject unwanted submissions. ### A defined destination Enquiries go to info@mujeer.com. The website does not store submitted messages in a database. The email and any resulting business records are handled through the company’s enquiry and engagement process. ### Privacy by choice Google reCAPTCHA loads only when you enable the protected contact form. This website has no advertising pixels or analytics trackers. The contact page uses a necessary session cookie. ### Limited public exposure The public website has no customer login, database or file-upload feature. Private configuration and runtime storage are excluded from the company website’s public routes and protected from HTTP access. Page output is escaped and routes are explicitly defined. ### Separate product requirements Each app, integration and client deployment has its own data flows, permissions and provider settings. Review its current privacy notice and marketplace disclosures, then agree the controls required for your use case. Website implementation & verification details Reviewed 12 November 2026 through MUJEER’s implementation checks and release verification. This describes the website release, rather than an independent certification or penetration-test report. HTTPS and HTTP response policies: Content Security Policy, framing restrictions, content-type protection, referrer and browser-permission controls. Server-side field and request limits, session CSRF and origin checks, honeypot and timing checks, and hashed, file-locked abuse limits. reCAPTCHA validation on the server, including the expected hostname and action, score threshold and challenge freshness. Incomplete security checks prevent submission. A Secure, HttpOnly, SameSite contact-session cookie; escaped page output; private runtime configuration protected from public HTTP access. Release checks cover protected-path access, negative form cases, browser behavior and deployed-file integrity. Submitted message text and raw IP addresses are not written to application logs; hosting-provider logs are handled separately. For procurement that requires an independent assessment, confirm its system scope, date, assessor and deliverables during project scoping. 02 / Your enquiry ## Know where your information goes. 01 ### You choose what to send Name, work email, optional company, area of interest and a project message. Leave out passwords, payment details and sensitive customer records. 02 ### The form is checked Server validation and abuse controls check the request. Enabling the protected form loads Google reCAPTCHA for the security check. 03 ### The enquiry is emailed An accepted message is sent to info@mujeer.com. This website keeps no submission database. 04 ### You can ask about your data Contact info@mujeer.com for an enquiry-related access, correction or deletion request. Business and legal retention requirements may still apply. [Privacy Policy](/privacy) [Protected contact form](/contact) 03 / Your project ## Agree the controls. Name the owners. Requirements and responsibilities belong in your project and support agreements. Recovery targets, assessment scope and service coverage depend on the actual system and agreed service. Access & identity Agree user roles, least-privilege access, administrator ownership, authentication requirements and how access is removed when people or responsibilities change. Data & service providers Map what is collected, where it is processed and who can access it. Agree transport/storage protection, retention, export and deletion, along with hosting, payment, messaging and AI provider responsibilities. Backups & recovery Specify the backup owner, schedule, retention and storage location. Define recovery-point and recovery-time objectives, and agree who performs and records restore tests. Testing & release Define acceptance checks for permissions, important workflows and integration failures. Agree the scope of any vulnerability assessment or penetration test, who performs it, and how findings are resolved. Incidents & maintenance Name incident contacts and escalation routes. Agree update ownership, support hours, response targets by severity, maintenance windows and communication responsibilities. AI & automation boundaries Specify approved knowledge sources, permitted tools, data sent to providers, human approvals and fallback behavior. Validate these boundaries against the intended workflow before enabling consequential actions. [Ownership & project commitments](/transparency#before-work-begins) [Delivery & support](/support) 04 / Report a concern ## Help us understand what you found. Email [info@mujeer.com](mailto:info@mujeer.com?subject=Website%20security%20report) with the subject “Website security report”. Include the affected URL, a short description, safe reproduction steps, the potential impact and a way to contact you. ### Share only what is needed Do not include passwords, verification codes, access tokens, full payment details or private customer records. Redact sensitive information from screenshots. Ask for a suitable exchange method before sending sensitive material. ### Keep testing within permission This reporting guidance covers this MUJEER company website. Contact us to clarify scope before testing. Do not access another person’s data, change records, interrupt services or test third-party systems without permission.