Security

TrueFunds collects a small amount of business information in order to review a funding request. This page describes the controls that protect it. We have deliberately written it as a description of what is implemented rather than as a list of badges: where we do not do something, we say so.

1. Transport

Every connection to this site is encrypted with TLS. The site is served with HTTP Strict Transport Security at a two-year max-age, applied to all subdomains and submitted for browser preloading, so a browser will refuse to connect to this domain over plain HTTP even on a first visit. Insecure sub-resource requests are upgraded rather than loaded.

2. Browser hardening

The site sends a restrictive Content Security Policy that confines scripts, styles, frames and network connections to known origins, blocks plugin content outright and restricts what may embed the page. Alongside it: X-Frame-Options: DENY so the site cannot be framed for clickjacking, X-Content-Type-Options: nosniff so a response cannot be reinterpreted as a different content type, a strict referrer policy so your browsing context is not leaked to third parties, and a permissions policy that denies camera, microphone and geolocation access to this site and anything it loads.

3. Form protection

Forms on this site are protected by Cloudflare Turnstile. The token a browser produces is verified server-side against Cloudflare before a submission is accepted, so the check cannot be bypassed by calling the endpoint directly. This is a bot control, not an identity check, and it does not profile you.

4. Opt-out links cannot be forged

Every unsubscribe link carries a token derived from your address with HMAC-SHA256 under a secret held only on the server, and the comparison is constant-time. A link therefore cannot be guessed, edited to target somebody else’s address, or used to enumerate who is on a list. Opt-outs are recorded on a suppression list and forwarded to the sending provider. You can opt out here at any time.

5. Database access

There is no database client in your browser. Writes happen only in server-side route handlers, using a service key that is never exposed to the client bundle, and the connection is scoped to this brand’s own schema rather than to the database as a whole.

6. What we do not collect

This site does not ask for and does not store a Social Security number, a bank login, a card number or a bank account number. A funding request on this site collects your name, business email, ZIP code and the amount you are asking about; the contact form collects your name, email, company, subject and message. Where a third-party funder needs verification material, that is collected on that funder’s own system under that funder’s agreement, not here.

Reviewing your funding options uses a soft inquiry and leaves your score untouched. See our Privacy Policy for what we do collect, how long we keep it and who it is shared with.

7. What this page does not claim

We are a small operation and we would rather be accurate than impressive. TrueFunds does not currently hold SOC 2, ISO 27001 or PCI certification, and we do not claim otherwise. We do not operate multi-factor authentication or biometric verification, because this site has no customer login to protect. We do not use blockchain for anything.

8. Reporting a vulnerability

If you believe you have found a security issue, email support@truefunds.net with enough detail to reproduce it, or call +1 (480) 555-0173. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We do not currently run a paid bounty programme.