This page explains the security measures we implement to protect your connection to apexintell.tech. As a company building intelligence-grade systems and secure software, we take website security seriously.
Your Connection is Secure: All traffic to our website is encrypted using HTTPS with TLS 1.3, ensuring that your data cannot be intercepted or tampered with during transmission.
1. What is HTTPS?
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, the protocol used to transfer data between your browser and our website. The "S" stands for "Secure" and indicates that all communications are encrypted.
How HTTPS Works
- Encryption: Data is scrambled using cryptographic algorithms so only authorized parties can read it
- Authentication: SSL/TLS certificates verify that you're connecting to the real apexintell.tech, not an impostor
- Data Integrity: Ensures data hasn't been tampered with or corrupted during transmission
2. Our Security Implementation
TLS Protocol
We use TLS 1.3 (Transport Layer Security), the latest and most secure version of the encryption protocol. Benefits include:
- Faster Handshakes: Reduced latency for establishing secure connections
- Stronger Encryption: Removes weak ciphers vulnerable to attacks
- Perfect Forward Secrecy: Even if a key is compromised in the future, past communications remain secure
- Zero Round-Trip Time (0-RTT): Improved performance for returning visitors
SSL/TLS Certificate
Our website uses a valid SSL/TLS certificate issued by a trusted Certificate Authority (CA). This certificate:
- Verifies our identity as Apex Intell Tech SRL
- Enables browser padlock icon and "Secure" indicator
- Is automatically renewed before expiration
- Covers all subdomains and pages on our site
Cipher Suites
We support only modern, secure cipher suites:
- AES-256-GCM: Advanced Encryption Standard with 256-bit keys (military-grade encryption)
- ChaCha20-Poly1305: High-performance cipher for mobile devices
- ECDHE: Elliptic Curve Diffie-Hellman Ephemeral for perfect forward secrecy
We explicitly disable:
- RC4, MD5, SHA-1 (weak or broken algorithms)
- SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1 (outdated protocols with known vulnerabilities)
- Export-grade ciphers (intentionally weakened for legacy compliance)
3. Security Headers
We implement HTTP security headers to protect against common web vulnerabilities:
| Header | Purpose |
|---|---|
Strict-Transport-Security (HSTS) |
Forces browsers to always use HTTPS, preventing downgrade attacks |
Content-Security-Policy (CSP) |
Prevents XSS (cross-site scripting) by restricting resource loading |
X-Frame-Options |
Prevents clickjacking by blocking iframe embedding |
X-Content-Type-Options |
Prevents MIME-sniffing attacks |
Referrer-Policy |
Controls what information is sent in HTTP referrer headers |
Permissions-Policy |
Restricts browser features (camera, microphone, geolocation) |
4. HSTS (HTTP Strict Transport Security)
Our site is configured with HSTS preloading, which means:
- Browsers will always connect via HTTPS, even if you type "http://" in the address bar
- Protection against SSL-stripping attacks (man-in-the-middle attempts to downgrade to HTTP)
- Our domain is included in browser HSTS preload lists (Chrome, Firefox, Safari, Edge)
- HSTS policy applies to all subdomains
HSTS Configuration
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
- max-age=31536000: Policy enforced for 1 year (365 days)
- includeSubDomains: Applies to all subdomains
- preload: Eligible for browser preload lists
5. Certificate Transparency
Our SSL/TLS certificates are logged in public Certificate Transparency (CT) logs, enabling:
- Detection of mis-issued or fraudulent certificates
- Public audit trail of all certificates issued for our domain
- Compliance with browser CT requirements (Chrome, Safari)
You can verify our certificates at crt.sh or Google Transparency Report.
6. OCSP Stapling
We use OCSP Stapling (Online Certificate Status Protocol) to improve security and performance:
- Faster: Reduces TLS handshake time by eliminating browser queries to certificate authorities
- Privacy: Prevents leaking browsing history to CAs via OCSP requests
- Reliability: Works even if CA's OCSP responder is offline
7. Perfect Forward Secrecy (PFS)
All our cipher suites support Perfect Forward Secrecy, meaning:
- Each session uses a unique encryption key
- Compromising one session key doesn't expose past or future sessions
- Protection against retroactive decryption if the server's private key is stolen
8. Protection Against Common Attacks
| Attack Type | Our Protection |
|---|---|
| Man-in-the-Middle (MITM) | TLS encryption + HSTS + Certificate pinning |
| SSL Stripping | HSTS preloading + HTTPS-only cookies |
| Clickjacking | X-Frame-Options: DENY header |
| Cross-Site Scripting (XSS) | Content-Security-Policy (CSP) with strict directives |
| Protocol Downgrade | TLS 1.3 only, legacy protocols disabled |
| BEAST, CRIME, BREACH | Modern ciphers, TLS 1.3 eliminates vulnerabilities |
| Heartbleed | Patched OpenSSL, regular security updates |
9. Server Security
Our hosting infrastructure (Romarg, Romania) implements:
- Firewalls: Restrict unauthorized network access
- Intrusion Detection: Monitor and block malicious activity
- DDoS Protection: Mitigate distributed denial-of-service attacks
- Regular Updates: Automated security patches for server software
- Access Controls: SSH key-based authentication, no password logins
- Log Monitoring: 24/7 security event logging and analysis
10. Data in Transit vs. Data at Rest
Data in Transit (This Page)
Encrypted via HTTPS/TLS 1.3
- All traffic between your browser and our server is encrypted
- Prevents eavesdropping on public Wi-Fi or untrusted networks
- Protects cookie values, form submissions (if we add forms)
Data at Rest
Server-side storage security
- Server logs encrypted at rest (AES-256)
- Regular backups stored in encrypted format
- Database encryption (if we implement databases in the future)
11. Browser Security Indicators
When you visit our site, your browser should display security indicators:
Positive Indicators
- Padlock Icon: Appears in the address bar
- "Secure" or "Connection is Secure": Text next to URL
- Green Address Bar: Some browsers highlight HTTPS connections
- Certificate Details: Click padlock to view our SSL certificate
Warning Signs (What to Avoid)
- "Not Secure" warning → Site using HTTP (never apexintell.tech)
- Certificate error → Expired, self-signed, or mismatched certificate
- Mixed content warning → HTTP resources loaded on HTTPS page
12. Compliance and Standards
Our security implementation complies with:
- PCI DSS: Payment Card Industry Data Security Standard (future payment processing)
- GDPR Article 32: Security of processing (encryption as technical measure)
- eIDAS Regulation: EU electronic identification and trust services
- ISO/IEC 27001: Information security management best practices
- OWASP Top 10: Protection against common web vulnerabilities
- NIST Guidelines: U.S. National Institute of Standards and Technology recommendations
13. Testing and Verification
You can independently verify our HTTPS security using these tools:
- SSL Labs: SSL Server Test (should score A or A+)
- Security Headers: securityheaders.com
- Mozilla Observatory: observatory.mozilla.org
- HSTSPreload: hstspreload.org
14. Reporting Security Issues
If you discover a security vulnerability or issue with our HTTPS implementation, please report it responsibly:
Security Contact:
Email: office@apexintell.tech
Subject Line: "Security Vulnerability Report"
Please include:
- Detailed description of the vulnerability
- Steps to reproduce (if applicable)
- Potential impact and severity
- Your contact information (optional, for acknowledgment)
We commit to:
- Acknowledge receipt within 48 hours
- Investigate and respond within 7 days
- Apply fixes and notify you of resolution
- Credit responsible disclosure (with your permission)
15. Updates and Maintenance
We continuously monitor and update our security infrastructure:
- Certificate Renewal: Automated via Let's Encrypt / Certbot
- Security Patches: Applied within 48 hours of release
- Protocol Updates: Adopt new TLS versions as browsers support them
- Vulnerability Scanning: Weekly automated scans
- Penetration Testing: Annual third-party security audits (planned)
16. User Responsibilities
To maximize your security when visiting our site:
- Use Updated Browsers: Chrome, Firefox, Safari, Edge (latest versions)
- Avoid Public Wi-Fi: Use VPN on untrusted networks
- Check the Padlock: Verify "Secure" indicator before entering sensitive data
- Enable HTTPS-Only Mode: Available in most modern browsers
- Beware of Phishing: Verify URL is exactly "apexintell.tech" (not similar-looking domains)
17. Future Enhancements
Security improvements we're evaluating:
- HTTP/3 (QUIC): Next-generation protocol with improved performance and security
- CAA Records: DNS Certification Authority Authorization for certificate issuance control
- Expect-CT Header: Certificate Transparency enforcement
- Subresource Integrity (SRI): Verify third-party scripts haven't been tampered with
18. Contact Information
For questions about our HTTPS security implementation:
Apex Intell Tech SRL
Email: office@apexintell.tech
Phone: +40 727 211 030
Address: 9 Vasile Topliceanu Sg. Maj., Bucharest, Romania
Summary: We use industry-leading HTTPS security with TLS 1.3, HSTS preloading, modern cipher suites, and comprehensive security headers to protect your connection. Your data is encrypted end-to-end during transmission.