ES
Security — Computer Engineer · Cybersecurity specialist

Security bydesign

Every site I deliver is born hardened. HTTPS, strict headers, backups and least privilege aren't an add-on bolted on at the end: they're how it gets built. Here's exactly what I do, how you can verify it yourself, and what the Shield plan adds.

Dox Designs (Santiago Miranda, Computer Engineer with a specialization in Cybersecurity, Cali, Colombia) delivers websites hardened by design: HTTPS with HSTS, a strict Content-Security-Policy, automatic backups, encryption and access control, with technical guidance for GDPR/CCPA-ready privacy.

  • Transport and headers

    What a browser demands before trusting a page.

    • HTTPS always, with HSTS and preload
    • Content-Security-Policy with no inline scripts and no unauthorized third parties
    • Protection against framing, MIME sniffing and referrer leaks
    • Browser permissions locked down (camera, microphone, geolocation)

  • Data

    Your customers' and your own.

    • Encryption in transit and at rest
    • Least privilege: every access sees only what it needs
    • Nothing is stored that doesn't need storing
    • Passwords and credentials never in plain text

  • Continuity

    So a failure isn't a loss.

    • Automatic backups and tested restores
    • Uptime and change monitoring
    • Patches and updates inside the monthly cycle
    • A log of what changed and when

  • Domain and email

    So nobody can impersonate you.

    • Protected DNS and transfer lock
    • SPF, DKIM and DMARC against email spoofing
    • security.txt so a researcher knows who to tell
    • Domain and certificate renewals watched
This site is the proof

The headers doxdesigns.dev runs with

Not a list of intentions: these are the real headers this site sends with every response. Every site I deliver ships with the same ones.

HTTP/2 200 · doxdesigns.devvercel.json
Content-Security-Policy
Only first-party code and the two authorized analytics tools run. An injected script doesn't.
Strict-Transport-Security
Two years of mandatory HTTPS, subdomains included, on the browsers' preload list.
X-Frame-Options: DENY
Nobody can wrap the page in an iframe to trick a visitor.
X-Content-Type-Options: nosniff
The browser doesn't guess file types: a disguised file doesn't execute.
Referrer-Policy
Leaving for another site doesn't leak the full URL you came from.
Permissions-Policy
Camera, microphone, geolocation, payments and sensors are off: the page doesn't need them and doesn't ask.
Cross-Origin-Opener-Policy
A tab opened from another site can't manipulate this one.

Verify it with securityheaders.com or Mozilla's Observatory: just paste the domain.

See this site's security.txt (opens in a new tab)
In every plan

What security each orbit carries

The baseline goes into every plan, because a site isn't delivered half-done. The Shield plan is for anyone who stores customer data and also needs auditing and compliance.

  1. Base

    • HTTPS + HSTS and strict headers
    • Backups and monitoring
    • Protected domain and email

  2. Growth

    • Everything in Base
    • Shield status in every telemetry report
    • Monthly access and patch review

  3. Shield

    • Everything in Growth
    • Technical security audit
    • Encryption, least privilege and access control
    • GDPR/CCPA-ready privacy setup and guidance
Privacy law

Personal data and compliance

Any business that stores customer data — names, phone numbers, emails, records — falls under a privacy law: the GDPR in Europe, the CCPA in California, Law 1581 in Colombia and their equivalents elsewhere. All of them ask for the same things: a privacy policy, a lawful basis for collecting the data, security measures and a way for people to exercise their rights. The Shield plan covers the technical side: how data is collected, where it lives, who can access it and how it's deleted.

Technical guidance: I prepare your site and processes to comply; I don't replace a lawyer's judgment.

Security questions

What people usually ask

Yes, though less of it. A site with no forms still has a domain that can be spoofed, a certificate that expires and a server that can go unpatched. That's exactly why the baseline — HTTPS, headers, backups — is in every plan.

The audit includes security

In the free audit I check your certificate, your headers, what data your site exposes today and what risks there are in the information you handle. In writing, within 48 hours, whether you hire me or not.

See the Shield plan