01Platform controls
- HTTPS only, with HSTS on reboulo.com.
- Strict Content-Security-Policy: scripts, fonts and images load only from reboulo.com. No third-party trackers, fonts or widgets.
- Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy.
- No visitor data is stored on the web server by this site: quote requests travel by email, and drafts stay in your browser.
- Planned with the client portal (phase 2): server-side validation, rate limiting, bot protection, role-based access and audit logs.
02Commercial compliance
- Where the law of the contracting entity's country requires it, that entity carries out customer identification (KYC) before contracting.
- Cross-border orders may be subject to sanctions and export-control rules; the contracting entity may decline an order that conflicts with them.
- Product certificates are shown only when verified and current.
03Report a vulnerability
Email info@reboulo.com with subject “Security”. Please do not access data that is not yours or disrupt the service. We will acknowledge within 5 working days.
Last updated: 2026-10-18 · This draft must be reviewed by qualified counsel in Portugal, the UAE and Egypt before publication.