Secure transport
The public website is served over HTTPS and uses HTTP Strict Transport Security to keep supported browsers on encrypted connections.
Security & Trust
Security is part of the architecture, not a launch-day add-on.
SHEARR is being built for businesses that depend on operational, commercial, workforce and financial information. That means security, privacy and traceability need to be designed into the platform and the way it is delivered.
Public website
Controls already protecting shearr.co.uk.
These are current controls on the public marketing website. They are deliberately separated from the SHEARR application itself, which remains in active development and will undergo additional security validation before production customer use.
Browser protections
Content Security Policy, framing restrictions, content-type protection, referrer controls and a restrictive permissions policy reduce common browser-side attack paths.
Supply-chain checks
Production builds use a committed lockfile, deterministic dependency installation and a CI security audit that fails on high-severity dependency findings.
Dependency monitoring
Automated dependency monitoring is enabled so security and maintenance updates are surfaced for review rather than relying on manual checks.
Form protection
Public contact submissions are validated server-side, use anti-automation checks and apply limits to request size and input length. Further distributed rate limiting is planned before higher-volume traffic.
Minimal tracking
The website does not use advertising trackers. Website analytics and performance measurement are provided through Vercel services described in our privacy and cookie information.
Platform principles
The controls SHEARR is being built around.
We will only publish production-security claims when they have been implemented and verified. The principles below describe the direction of the application architecture rather than claiming certification that has not yet been completed.
Tenant isolation
Customer data separation is treated as a core architectural requirement of the SHEARR application, not an optional feature added later.
Least privilege
Roles and permissions are being designed so users receive the access needed for their work without unnecessary visibility or control.
Auditability
Operational and financial actions are being designed with traceability in mind so significant changes can be reviewed and understood.
Secure delivery
Security review, dependency management, automated checks and deployment validation form part of the release process while the platform is developed.
Before production launch
Evidence matters more than security slogans.
The production-readiness programme includes application security testing, tenant-isolation verification, permission testing, dependency review, backup and recovery validation, audit-trail checks and independent penetration testing when the application reaches the appropriate stage.
As those controls are completed, this page will be expanded with the verified detail customers need for due diligence.
Security questions
Need to understand how SHEARR will handle your requirements?
Tell us what your organisation needs to satisfy before adopting a connected operational platform. We would rather address the requirement explicitly than hide it behind generic claims.