Security
Last reviewed: July 15, 2026
Del Portal Technologies designs, builds, and operates high-availability systems. Security is not a layer we add at the end: it is a design decision from day one. This page explains how we approach it — in the systems we build and in this site itself — with the same candor we bring to documenting any production system.
We do not use terms like “unbreakable” or “military-grade.” We describe what we do, where its limits are, and how to verify it. For a technical audience, transparency is the only defensible posture.
This page is for information purposes only and describes general practices in effect as of its review date. It does not constitute a certification, a guarantee of invulnerability, a service-level commitment (SLA), or a contractual obligation. The binding obligations applicable to each product or service are solely those contained in its contract, EULA, terms, or corresponding security addendum.
Defense in depth. We combine controls across network, application, data, and operations to reduce the likelihood that the failure or compromise of one layer affects the entire system.
Least privilege. We apply the principle of least privilege and seek to ensure that each component, service, and person accesses only the resources necessary for their function. Permissions are granted explicitly and reviewed periodically according to risk.
Encryption in transit and at rest. Communications under our control are protected with TLS or other secure protocols where the architecture and protocol allow. Personal or confidential data at rest is encrypted where appropriate according to its nature, risk, and the capabilities of the service used. We do not design our own cryptography.
Secure development. We review code, control dependencies, and keep the attack surface to a minimum. We favor simple, auditable architectures over complexity that hides risk.
Operations and response. We monitor the systems we operate and manage incidents in accordance with internal procedures and applicable regulations. When an incident affects personal data, we act in accordance with Peru's Law No. 29733 and its Regulation, including notifying the authority where required.
Static site. delportaltechnologies.com is published as a static export: there is no server runtime or database exposed behind the site, which drastically reduces the attack surface.
Encryption enforced. The site is served over HTTPS only, with HSTS (including preload): any access over HTTP is redirected to the encrypted version.
Strict Content Security Policy (CSP). It restricts where scripts, styles, and connections may load from; it blocks embedding the site in third-party frames and any unauthorized active object.
No tracking. We use no tracking cookies, fingerprinting, or cross-site tracking. Traffic measurement uses a cookieless tool. Del Portal receives only aggregate metrics and no persistent identifiers or individual profiles.
Minimal data. The contact form opens your own email client: there is no backend storing your message. Support tickets travel encrypted and are described, along with our data processors, in the Privacy Policy.
No system is completely infallible. We design to reduce the likelihood of an incident and to contain its impact, not to promise the impossible.
The security of a running system also depends on its environment and the people who use it. Good practices on the user's side — updated devices, strong credentials, care against phishing — are an inseparable part of protection.
We do not publish certifications we do not hold. When we obtain external audits or certifications, we will state them here, with their scope and date.
If you identify a possible vulnerability in this site or in a system we operate, you may report it to security@delportaltechnologies.com.
We will endeavor to acknowledge receipt and assess reasonable reports made in good faith. The fix, coordination, and any recognition will depend on the validity, severity, scope, and technical feasibility of the finding.
Submitting a report does not authorize access to third-party data, alteration of systems, disruption of services, or any unlawful activity. We appreciate that the finding not be publicly disclosed for a reasonable period while we assess it and, where applicable, implement corrective measures, unless there is a legal disclosure obligation.