Separate domains and responsibilities
Public content, the protected application and API functions remain distinct surfaces with different access rules.
Trust & security
Explain the work. Protect the machinery.
The public website is intentionally separate from the authenticated application and internal research systems. It contains only information selected for public release.
Security boundary
Sensitive data is protected by absence, not camouflage.
A public page can always be read and copied by a visitor. The meaningful protection is to ensure proprietary logic and operational data are never placed in the public webroot in the first place.
Public website
- Company and product narrative
- High-level agent purpose
- Research and governance principles
- Public status and limitations
- Static assets only
Protected laboratory
- Authenticated research access
- Detailed operational evidence
- Run and portfolio telemetry
- Internal decision parameters
- Restricted application APIs
Design principles
Defence in layers.
Publish only what is needed
No credentials, private endpoints, infrastructure maps, thresholds, live balances or source-level research recipes belong in public files.
Constrain the browser
The public site uses a restrictive content policy, secure transport and framing, referrer and capability protections.
Protect lab access
Operational views require an authenticated session and the appropriate application entitlement.
Preserve evidence
Research identities and decision history are designed to remain attributable and reviewable.
Deploy reversibly
Public releases are versioned so a tested prior release can be restored without touching research data.
Public code cannot leak what it never receives.
This website does not call the research API, set an authenticated session, request portfolio data or embed operational configuration.
Public privacy posture
A deliberately small data footprint.
These public pages do not include analytics, advertising trackers, contact forms or application API requests. They do not set marketing cookies. A link to the laboratory starts a separate request to the protected application.
Like any website, technical connection data may be handled by hosting, network and security infrastructure to deliver and protect the service.
- No third-party analytics scripts
- No advertising or behavioural profiling
- No public collection form
- No browser access to internal research APIs
- No operational data embedded in source files
Protected access
The laboratory remains a separate authenticated environment.
Only approved users should proceed to the application. Public information does not imply access to internal research or future live-operation capabilities.