Legal
Security
Where the information you send through this website is kept, who can see it, and how to report a problem.
Where your information is kept
The website runs on Vercel in its Washington, D.C. region. Inquiries are stored in a Supabase database in the US West (Oregon) region and emailed to our business inbox, which Google hosts. Resumes are not stored on the website: they go straight to that inbox as email attachments.
Who can see it
In the database, only signed-in website administrators can read what visitors send. The database enforces this itself: a visitor can submit a form but cannot read anything that was submitted. The copies emailed to our business inbox are read by the staff who answer inquiries and review applications. Changes made in the admin area are recorded in an audit log.
How the site is protected
Every page loads over HTTPS, and browsers are told never to fall back to plain HTTP. A content security policy limits what the pages can load, and other websites cannot show this site inside a frame. Forms check what they receive and limit repeated submissions, and resumes must be PDF or Word files under 4 MB. The site uses no advertising or tracking cookies; the privacy notice has the details.
On client projects
Work in your systems follows the working practices on How we work, including named, least-privilege accounts, changes tested in a sandbox first, and access removed at the end of the engagement.
Report a security problem
Email info@vachiservices.com with what you found and how to reproduce it. Please don't access other people's data or disrupt the site while testing. The same contact is published for security tools at /.well-known/security.txt.
Last updated October 29, 2026.