Security Practices

This page is maintained by Kondo's Koncrete LLC to answer common security questions about kondoskoncrete.com. It describes the controls currently in place. It is not a certification or an independent audit.

Site & Transport Security

• All traffic is served over HTTPS with TLS encryption in transit.
• A Content Security Policy restricts which scripts, styles, and resources can load.
• A strict referrer policy limits what we share with third-party sites.
• The site contains no hardcoded credentials or API keys.

Form & Input Security

• Quote requests are validated in the browser and again on the server using a schema-based validator.
• Field length limits and allow-lists reject oversized or unexpected input.
• All submitted content is escaped before it is used in notification emails.
• Errors return generic messages — no stack traces or internal details are exposed.

Hosting & Infrastructure

The website is hosted on managed cloud infrastructure operated by our web partner. Server infrastructure, backups, and platform patching are handled by the hosting provider. Form delivery runs on a managed serverless function with secrets stored in an encrypted secret store, never in source code.

Known Limitations

Because the site is served as a static application, some protections that normally require custom HTTP response headers (such as HSTS and X-Content-Type-Options) are applied by the hosting platform rather than by us, and our Content Security Policy is delivered as a document-level meta tag. Automated rate limiting on the quote form is not currently available on our platform; submissions are monitored manually.

Shared Responsibility

Kondo's Koncrete LLC is responsible for the content of this site and how we handle the information you send us. Our hosting platform is responsible for the underlying servers, network, and platform-level security features. You are responsible for keeping your own device and email account secure.

Reporting a Security Concern

If you believe you have found a security issue with this website, please contact us at 330-553-8060 or through our Contact page. Please do not publicly disclose the issue until we have had a chance to respond.