How this site
is built.

The Content-Security-Policy only lets the browser run script files served from this domain, plus two named Cloudflare scripts: the verification check and the cookieless analytics beacon. Inline <script> blocks and onclick handlers are refused. Styles may still use inline attributes; scripts may not.

Why it matters to a clientIf someone ever managed to inject markup into a page, it still could not run code in your visitors’ browsers. It also forces every behaviour into a named, reviewable file.

They check that every public page carries the legal company details, has exactly one main heading, includes the assistant dialog, leaks no internal project names, and that every internal link and asset resolves. The assistant’s rules — refusing cross-origin requests, bounding message length, never quoting prices — are tested too.

Why it matters to a clientA broken link, a missing company number or a page that quietly lost its heading is caught before it ships, not reported by a visitor.

The build copies 21 named pages and 70 named files. There is no folder copy and no wildcard, so drafts, internal documents and old assets cannot reach the live site by accident.

Why it matters to a clientNothing is published unless someone decided to publish it. For a client, that means private files stay private.

The site has no framework and installs nothing from npm. Scroll animation uses 2 self-hosted, version-pinned files (ScrollTrigger.min.js, gsap.min.js), served from this domain.

Why it matters to a clientFewer moving parts means fewer security updates, nothing to break when a package changes, and a site that still works in five years.

Every page is plain HTML generated ahead of time and served by Cloudflare Pages. The only server code is the optional assistant endpoint, which is off unless it is explicitly configured.

Why it matters to a clientFast everywhere, very little to attack, and almost nothing to run or pay for month to month.

Archivo, Doto and JetBrains Mono are served from this domain, so no font request goes to a third party. The background films and renders behind each page were generated with Google Gemini and are decorative only: they never stand in for real work, real clients or real people. The films stay still if your device asks for reduced motion or data saving.

Why it matters to a clientFaster pages, no tracking through font services, and no stock photography pretending to be something it is not.

Visible focus on every control, a skip link, a native dialog for the assistant with focus kept inside it, keyboard-operable selectors, and animation that stops when your device asks for reduced motion.

Why it matters to a clientMore people can use it — and a site that works with a keyboard usually works better for everyone.