Trust by design
Security approach
Public website
The public site is intentionally low-data. It does not accept file uploads, process payments or store enquiry-form submissions. The contact form opens a draft in the visitor’s own email application.
Enquiries
The public website does not offer an AI chat. Enquiries go through the visitor’s email app to our business email address, not through a public chatbot.
Existing client portal
The client portal is a separate application with its own access controls. Changing this public website does not alter existing client workspaces or connected accounts.
Operational principles
- Client accounts and provider relationships remain client-owned.
- Secrets must be stored in protected server configuration, never source control or page content.
- Access should be least-privilege, role-aware and revoked when no longer needed.
- Material publishing, spending and account changes should remain approval-led.
- Dependencies, redirects, headers and important journeys should be tested before release.
Responsible reporting
If you believe a Zarak-managed service has a security issue, email info@zarakmarketing.com with the affected URL, a clear description and safe reproduction detail. Do not access, change or disclose another person’s information.
Limits
No internet service can promise absolute security. Security controls must be reviewed against the actual deployed application, providers and data flows. This page does not claim independent certification or complete immunity from risk.