TGG/SECURITY

Security is how we build, not a feature.

This page describes how TGG approaches security — in client systems and in our own. Principles first, then the practices this website itself is held to. We publish what is verifiable and nothing else.

01 — PRINCIPLES

Security by architecture

Controls belong in the system design. A control that lives only in a policy document doesn't exist under pressure.

Privacy by design

Collect the minimum, explain every field, delete on schedule.

Need-to-know access

Access is scoped to the mission, logged, and reviewed when the mission ends.

Minimal exposure

Small surfaces, few dependencies, nothing public without a reason.

Controlled infrastructure

We prefer environments we can reason about end to end — and we can say who holds every key.

Auditability

Decisions and changes leave evidence someone else can check.

02 — THIS WEBSITE

Held to the same standard.

The deployment baseline for tgg.group. Items ship with the production site and are verifiable in its headers and source.

TRANSPORTTLS everywhere, HSTS preload
HEADERSStrict CSP, frame denial, no-sniff, referrer policy
THIRD PARTIESNo marketing pixels, no fingerprinting, minimal external scripts
CONTACT ENDPOINTServer-side validation, rate limiting, spam controls, minimal retention
SUPPLY CHAINPinned dependencies, automated audit in CI, no secrets client-side
ANALYTICSPrivacy-oriented, aggregate-only — or none at all

03 — REPORTING

Found something? We want to know.

Good-faith security research is welcome. Scope, commitments and safe-harbor terms are documented.

Responsible disclosure →