Answered by engineers, not sales.
Send yours before the scoping call if it is a gate. We would rather fail it early than waste a quarter of your time.
Operations & data
How it is built, shipped, and run.
Specifics rather than adjectives. Everything on this page is either a control you can verify against this site right now, or a plain statement of what we do and do not hold.
Transport & browser
Verifiable from your own console.
These are the response headers this site serves. They are the floor every stack we ship starts from: HTTPS only with a one-year HSTS lifetime, a content security policy that denies by default, no MIME sniffing, no third-party framing, and a locked-down permissions policy.
Open developer tools on this page and read them yourself. A security page you cannot check is marketing.
GET
response headers
strict-transport-security: max-age=31536000
content-security-policy: default-src 'self';
object-src 'none';
base-uri 'self';
frame-ancestors 'self';
form-action 'self'
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-
cross-origin
permissions-policy: camera=(), microphone=(),
geolocation=(), …Delivery
CI
deploy pipeline
pull request → build → preview URL
reviewed in a browser,
on its own host
merge to main → build → production
same artifact, no
hand-copied files
rollback → previous release
one action, no rebuildNothing reaches production by hand.
Every change goes through the same pipeline: a pull request builds a preview on its own URL so it can be reviewed as a running thing rather than as a diff, and a merge deploys the identical artifact to production. Releases are immutable, so rolling back is selecting the previous one.
There is no server anyone SSHes into to fix something quickly. That is the point.
Data
Whose it is, where it sits, how it leaves.
- Ownership
- Your data is yours. Where you want it, it is delivered into infrastructure accounts your business controls, so ending an engagement never means negotiating for access to your own records.
- Card data
- Never touches our infrastructure. Payments are handled by Stripe; card numbers go from the customer's browser to Stripe directly. Cheeky-Fit Inc. is a participant in the Stripe Accelerate program.
- AI and your data
- Retrieval runs against your records to answer your questions. We do not train shared or third-party models on one client's data, and model choice is per workload so a provider can be changed without re-architecting.
- Access
- Least privilege, per person, removed when an engagement ends. Credentials live in managed secret storage, never in source.
- Deletion
- For Cheeky's own users, a self-serve route at /delete-my-account. For client systems, deletion behaviour is written into the build rather than bolted on after a request arrives.
- Privacy policy
- What Cheeky-Fit Inc. collects and why is at /privacy. Questions go to privacy@cheeky-fit.com.
What we do not claim
No badges we have not earned.
Cheeky-Fit Inc. holds no SOC 2, ISO 27001, or HIPAA attestation today, and we will not imply otherwise with a vague trust page. If your procurement requires a certified vendor, you will hear that in the first call rather than the fifth.
What we do offer is specificity: named controls, a pipeline you can audit, infrastructure in your own accounts, and answers to a security questionnaire from the engineers who built the thing.
You hear it from us first.
If something affecting your system goes wrong, you get told what happened, what was exposed, and what changed — not a status page euphemism.
Contact
Security questions get answered by the people who wrote the code.
Send a questionnaire, a disclosure, or a question about how something is run.