Transport boundary
The deployment design terminates HTTPS at the public reverse proxy; the application container is not published directly.
SECURITY & DATA
Security and data handling, stated without shortcuts.
A factual view of the public website and lead-capture architecture, including controls already implemented and production items still gated.
IMPLEMENTED CONTROLS
What the current architecture does.
Private data layer
Lead API and PostgreSQL services use an internal Docker network and do not publish database ports.
Minimal collection
Public forms ask only for routing and evaluation context and explicitly reject passwords or confidential project data.
Retention control
Lead records receive an expiry timestamp and are scheduled for deletion after 180 days.
Operational logs
Application logs omit message bodies, email addresses, IP addresses and SMTP secrets.
Container hardening
Public web and edge containers use read-only filesystems, reduced capabilities and no-new-privileges.
PUBLIC ENQUIRY DATA FLOW
01
Browser
A visitor submits the minimum fields and acknowledges the current privacy notice.
02
Lead API
Origin, size, timing, spam and schema checks run before storage.
03
PostgreSQL
The accepted enquiry and two notification jobs are written in one transaction.
04
Email outbox
Owner and applicant messages are delivered independently with bounded retries.
05
Expiry
Expired lead records are removed by the retention job.
PRODUCTION GATES
Open items are shown, not disguised.
- Lead capture is not enabled until production secrets and a real SMTP sender are configured.
- Backup location, restore evidence and recovery targets must be confirmed before sensitive pilot data is accepted.
- The final hosting and email subprocessors must be named in the Privacy Policy before public lead capture is enabled.
- Project-confidential data requires a separately agreed pilot scope and handling process.
Need a data-handling discussion?
Agree the scope before sharing project-confidential information.