Our website and email, checked live.

The form encrypts your message with OpenPGP, in your browser, to our public key, so our hosting and email delivery providers only ever handle it as encrypted text. Our server also refuses messages that aren’t in that format.

The page where you type loads code only from our own domain: the form’s bot check runs in a separate, isolated frame that your browser keeps from reading the page.

Our key’s fingerprint is 0095 85A5 FD39 28B6 9044 3D43 0A89 84A5 185F 2749. Download the public key and compare it in any OpenPGP tool.

To watch it work, open your browser’s developer tools on the Network tab and send the contact form on our homepage: your message is sent only as an encrypted block. To confirm this live, this page also sends our server short test requests. Our server refuses them on purpose, so they show as errors. They carry nothing you typed.

Plain HTTP redirects to HTTPS, and TLS 1.0 and 1.1 connections are refused. The value shows the version your own connection is using. Your browser’s developer tools show it too, and so does this command in a terminal that has curl and grep:

curl -svo /dev/null https://xovv.io 2>&1 | grep "SSL connection"

In content-security-policy, script-src allows only 'self', with no inline code, and require-trusted-types-for 'script' turns on Trusted Types, which blocks a common way of injecting code into a page in browsers that support it. The contact form’s bot check is allowed only as a frame from check.xovv.io. strict-transport-security has a max-age of one year (31536000 seconds), and browsers also have xovv.io on their built-in HTTPS-only list. Our pages send these headers; the bot check’s frame has its own, narrower policy. To see them:

curl -sI https://xovv.io

Our DMARC policy is p=reject at full strength, and our subdomains inherit it. Each receiving mail server decides how to apply it. Look it up with any DMARC lookup tool, or from a terminal that has dig:

dig +short TXT _dmarc.xovv.io

Enter xovv.io in any DNSSEC analyzer to see the full chain of signatures. From a terminal that has dig, this lookup should show the ad (authenticated data) flag:

dig +dnssec xovv.io @1.1.1.1

If your network redirects DNS lookups, the flag may not appear. This asks the same resolver over HTTPS and should show "AD":true:

curl -s -H "accept: application/dns-json" "https://1.1.1.1/dns-query?name=xovv.io"

Our content policy lets your browser load files only from this site. The contact form’s bot check is allowed only as a frame from our check.xovv.io subdomain; our hosting provider’s check runs inside that frame, which loads only after you start the form on our homepage and can’t read the rest of the page. This page carries none of our hosting provider’s analytics code. Like any website, ours is delivered by a hosting provider that receives basic technical details, such as your IP address, to serve pages. Our privacy page has the details.

To see for yourself, open your browser’s developer tools, choose the Network tab, and reload. Apart from anything your browser extensions add, every request this page makes goes to xovv.io, including the refused test requests described above.