Security & Computational Integrity
Our commitment to zero client tracking, strict edge security headers, and in-browser mathematical privacy.
1. Zero Server-Side State or Telemetry
Unlike conventional automotive configurators that require user account creation, capture lead forms, and log build dimensions to remote databases, VanBuildCalculator operates entirely within your browser's local sandbox.
Calculations are computed locally using compiled JavaScript with zero outbound API payloads. Your vehicle budget, electrical draw specs, and component choices remain strictly private on your device.
2. Hardened Edge Security Headers
All assets are served via Cloudflare Pages edge infrastructure with strict cryptographic and isolation headers:
- HSTS (HTTP Strict Transport Security): Enforces 256-bit TLS encryption across all connections (`max-age=31536000; includeSubDomains; preload`).
- Frame Protection: `X-Frame-Options: SAMEORIGIN` prevents clickjacking across the primary application, while dedicated `/embed/*` endpoints safely isolate widget consumers.
- MIME Sniffing Prevention: `X-Content-Type-Options: nosniff` prevents browser interpretation of content types.
- Referrer Policy: `strict-origin-when-cross-origin` shields sensitive path variables during outbound navigations.
3. Responsible Disclosure
If you discover an algorithmic flaw in our calculation engines or a security issue in our edge delivery pipeline, please reach out to our engineering team at security@vanbuildcalculator.online.