Trust Center · Security and privacy
How AppWT protects your sites and data
This page lists the security, privacy and assurance facts a buyer asks about, as measured on AppWT's server on October 25, 2026. Anything AppWT does not hold yet is stated plainly. Tony Paris has practiced web development since 1997. The practice has operated as AppWT since 2005 and incorporated in Michigan as AppWT LLC in 2020.
How sites and the server are protected
- appwt.com accepts only TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are refused, the certificate comes from Let's Encrypt, and HSTS is set with preload.
- Pages send a Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Root sign-in to the server over SSH requires a key.
- ConfigServer Security & Firewall (CSF) is active, and its login failure daemon blocks repeated failed sign-ins.
- A rate-based shield at the server edge runs every 2 minutes and drops traffic floods before they reach a site.
- Before the team changes a production file, a restore point is taken and restored once as a test.
Backups and recovery
- Every night, all databases on the server are backed up.
- The backup is then copied offsite, and the offsite copy is checked file by file against the original.
- Changed production files keep a tested restore point, so a change can be rolled back to the exact earlier bytes.
Monitoring
- Automated checks confirm AppWT's main sites answer every 15 minutes.
- Daily automated security scans of hosted site files and WordPress installs.
- Daily checks of certificate expiry and certificate coverage.
- A daily check that no backup file is reachable from the web.
- An automated shield that blocks card-testing traffic aimed at payment forms.
Where data is hosted
AppWT's websites, databases and email run on a server hosted by InMotion Hosting in the United States. Offsite backup copies are stored with Dropbox. Client projects can use a client's own cloud account when the contract calls for it.
Vendors that process data for AppWT
| Vendor | What it does for AppWT | Location |
|---|---|---|
| InMotion Hosting, Inc. | Server hosting for AppWT's websites, databases and email | United States |
| Postmark | Delivery of email sent by AppWT systems | Vendor-managed |
| Dropbox | Storage of offsite backup copies | Vendor-managed |
| Stripe | Card payments for online purchases (manuals.appwt.com) | Vendor-managed |
| Zoom | Appointment scheduling on appwt.com | Vendor-managed |
| Anthropic | AI models (Claude) used by the AppWT team for engineering, support and writing work, including work on client systems | Vendor-managed |
| Bland AI | AI phone assistant that answers some calls to AppWT phone lines | Vendor-managed |
| AppWT's text line, (734) 203-0171, runs on Google Voice | Vendor-managed |
This list covers vendors verified in use on October 25, 2026. A client project can add vendors named in its own contract. The AI Transparency Notice describes each AI assistant a visitor may reach and how to reach a person.
Privacy and responsible disclosure
- How AppWT handles personal information: Privacy Policy.
- The terms for standard plans: Terms of Service.
- Report a security issue to security@appwt.com or call +1 (888) 565-0171. The contact is also published at /.well-known/security.txt.
Assurance, stated plainly
| SOC 2 | AppWT does not hold a SOC 2 report today. SOC 2 readiness is on AppWT's work plan: written security policies and a gap assessment against the SOC 2 Security criteria come first, then an independent audit. This page will name the stage as it changes. |
|---|---|
| ISO 27001 and penetration testing | AppWT holds no ISO 27001 certification and has no independent penetration test report today. |
| HIPAA and PCI | The founder is HIPAA and PCI trained. That is training, not a certification. |
| Insurance | Commercial general liability insurance; certificate available on request. |
| Service levels | Enterprise contracts carry written uptime, response-time and recovery terms with service credits. Standard plans keep the current Terms of Service. |
| References | Enterprise work is under NDA. Scale and references are shared with qualified buyers. |
| Federal registration | SAM.gov registered: Unique Entity ID YN83P72KMX13, CAGE code 225X7. |
| BBB | A+ rating, accredited since July 1, 2022. |
Check the federal registration by searching the Unique Entity ID at SAM.gov. The W-9, insurance certificate and written security questionnaire answers are available on request, as listed on the Procurement page.
Common Questions
Does AppWT have a SOC 2 report?
No. AppWT does not hold a SOC 2 report today. SOC 2 readiness is on its work plan, starting with written security policies and a gap assessment against the SOC 2 Security criteria, then an independent audit. Security questionnaires are answered in writing, and any control that is not in place is stated as such.
Where are AppWT's websites and data hosted?
AppWT's websites, databases and email run on a server hosted by InMotion Hosting in the United States. Every night all databases are backed up and copied offsite to Dropbox, and the offsite copy is checked file by file against the original.
How do I report a security issue to AppWT?
Email security@appwt.com or call (888) 565-0171. The security contact is also published at appwt.com/.well-known/security.txt.
Next step
Send your security questionnaire, or see the work live under NDA.
