Single-use codes
Email codes are stored only as hashes, expire a few minutes after they are sent, allow a handful of attempts, and redeem atomically, so a code signs in exactly once. Requests are rate-limited per address and per IP.
Security
Built to be safe by having little to break.
A finished Ermaz site is static pages served over HTTPS, with no database and no login on it, so most of what usually goes wrong cannot happen here. This page says plainly how your account, your site and your enquiries are handled.
Identity
No passwords, anywhere.
Sign-in is Google or a single-use emailed code. There is no password to phish, leak or reuse.
Server-side sessions
Sessions are server records behind opaque HTTP-only cookies, bound to the host that created them. A fresh session id is issued on every sign-in, and you can sign out of every device from your account page.
Your sites are yours alone
A site's records, its enquiries and its visitor numbers, are reachable only by the account that made it. Ownership is checked on the server for every request, never inferred from the browser.
Your site
Static pages, nothing to breach.
Your finished site has no database, no admin login and no server code running on it. It is a set of files served over HTTPS from a content network, so there is no live system on the site for anyone to attack. Your full source is yours to download, so you are never locked in.
No cookies, no tracking
Visitor numbers are counted by a first-party beacon that sets no cookies, stores nothing on the visitor's device and keeps no IP addresses. Nothing on the page is a third-party tracker, which is why the site needs no cookie banner. You can switch counting off from your account.
Your enquiries stay yours
An enquiry from your site's form is emailed to you and kept in your records, reachable only by your account and gated on the server. Any photographs a visitor attaches are kept for 90 days and then removed.
Money-safe checkout
Payments go through Paddle as merchant of record, so Ermaz never receives or stores your card details. The checkout is created server-side, payment webhooks are signature-verified, and billing events are idempotent.
What Ermaz does not claim
No compliance certifications, no uptime percentage or service credits, no penetration-test attestations, and no independent backup guarantee. The Terms say exactly what is and is not promised. Encryption in transit is TLS everywhere, and what Ermaz stores for you lives on managed cloud infrastructure (see data processing).
Report a security issue
Use the contact form, and reports route directly to the operator and are answered by email.
Tell us about your business.
Describe it in your own words. Ermaz works out what the website needs, asks only what matters, and shows it working before you pay anything.
Start the conversation