By Shaheer Malik · Updated 29 October 2026
Quick answer: I am an independent designer and developer, not a certified company: I do not hold SOC 2 or ISO/IEC 27001. What I can show is how the work is set up: your domain, hosting and code stay in accounts you own, so access I use can be removed by you at any time, and you receive the code and design files at handover. Report a security issue to me@shaheermalik.com.
Everything stays in your name
The simplest security control is ownership. I work in accounts you own, so the access I use is access you granted and can remove.
| Domain and DNS | Registered in your name, at your registrar |
|---|---|
| Hosting and deploys | In your account, such as Framer, Cloudflare or Vercel |
| Code | In your repository; the full source is yours at handover, with no lock-in |
| Design files | Handed over to you, organised |
What this website collects
| Contact form and booking | Your name, email and project details, used only to reply to your enquiry |
|---|---|
| Analytics | PostHog records pages, clicks and sessions; anything you type is masked in recordings |
| Ads measurement | The Meta Pixel runs only on a few promotional pages reached from Meta ads |
| Free tools | They run in your browser and nothing you enter is uploaded, except the AI visibility score, which fetches the URL you give it |
| Deletion | Email me@shaheermalik.com and your information is removed |
The full detail is in the privacy policy. The free tools are built to run in the browser on purpose.
How this site is built
The site is a static export: pages are built ahead of time and served as files from Cloudflare Pages, so the public pages have no database behind them. Every change runs lint and type checks, and a deploy only goes live if the build passes. How changes are made and checked is described in let your team edit your website with Claude.
Report a security issue
Email me@shaheermalik.com with what you found and how to reproduce it. The site publishes a security.txt file in the format RFC 9116 defines, with the contact and an expiry date.
Security in the products I build
For client products, security decisions stay with your team. In the design I make access visible: who can see what, who changed what and when, and clear states for sharing and permissions. For companies selling to security-minded buyers, the cybersecurity page covers trust pages and security.txt for your own site.
Security questions
Are you SOC 2 or ISO 27001 certified?
No. I am an independent designer and developer, and I do not hold either. I work inside the accounts and policies your company already has, and I am happy to answer a security questionnaire.
Who owns the accounts and code?
You do. The domain, DNS, hosting and repository stay in your name, and you receive the full code and design files at handover.
How do I report a security issue on this site?
Email me@shaheermalik.com. The site also publishes a security.txt file at /.well-known/security.txt, in the format RFC 9116 defines.
Do the free tools upload my data?
No. They run in your browser. The one exception is the AI visibility score, which fetches the page at the URL you enter so it can check it.
Can you complete our vendor security questionnaire?
Yes. Send it with your brief and you will hear back within 24 hours, as with any enquiry.
Send your questionnaire with the brief
Share your security questionnaire with a couple of lines about the project. You will hear back within 24 hours.