Security

How this website handles your data today, and how to tell us about a security problem.

This page covers only what exists today: this website, its free tools and the Sub Paperwork waitlist. Sub Paperwork itself isn't built yet.

This website

• smallfirelab.com is a static website hosted on GitHub Pages. It has no user accounts and no logins.
• Pages are served over HTTPS. Plain HTTP addresses redirect to HTTPS.
• The site sets no cookies. Page views are counted by Cloudflare Web Analytics, which is cookieless.

The free tools run in your browser

• The COI expiry checker and the lien waiver log run entirely in your browser. What you type or paste into them is not sent to us. As on every page, only the page view itself is counted by Cloudflare Web Analytics.
• The lien waiver log saves what you enter in your browser's local storage on your device. Its "Clear all" button deletes it.
• Both tool pages set a Content Security Policy that only lets them load scripts from this site and Cloudflare's analytics, and blocks form submissions.

The Oregon license check

• The Oregon contractor license check sends what you paste to our checker on Cloudflare Workers, over HTTPS, which looks it up on data.oregon.gov. It doesn't store what you paste or the results; it keeps only daily totals of how many checks were run.
• The checker answers browser requests from other websites' pages only for this site, so another site can't use it from its visitors' browsers. It checks every input and limits how many checks one connection can run in a short time.
• Its page sets a Content Security Policy that only lets it load scripts from this site and Cloudflare's analytics, connect only to this site, Cloudflare's analytics and the checker, and blocks form submissions.

The waitlist

If you join the Sub Paperwork waitlist, your email address goes to Buttondown, our email service. Our privacy policy explains what we collect and how to have it deleted.