Verify, do not trust

Trust & Standards

What shahvatsal.com does, and a public way to check each item. Last reviewed .

Security

Transport security and browser protections that anyone can check with free public scanners.

  • HTTPS everywhere

    Every page is served over HTTPS.

    SSL Labs report

  • HSTS

    Strict-Transport-Security is sent for one year with includeSubDomains and the preload directive.

    HSTS preload status

  • Browser security headers

    Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are sent on every response.

    Security Headers scan

  • Edge protection

    The site is served through Cloudflare, which adds DDoS mitigation in front of the application.

    Response headers

  • Form hardening

    Forms use CSRF tokens, rate limits, a honeypot and a CAPTCHA challenge. Admin sessions use HttpOnly, Secure, SameSite cookies.

  • Vulnerability reporting

    A security.txt file (RFC 9116) lists the contact for responsible disclosure.

    Open security.txt

Privacy and data protection

Plain statements, not seals. They describe practice and are not a certification.

  • DPDP Act 2023 practices

    The site owner acts as Data Fiduciary under India’s Digital Personal Data Protection Act and explains purposes, retention and how to ask for access or deletion.

    Privacy Policy

  • GDPR-aligned principles

    Lawfulness, purpose limitation, minimization and security guide how EU and UK visitors’ data is handled.

    Privacy Policy

  • Consent before analytics

    Analytics (GA4, Tag Manager, Clarity) run only after you accept the consent banner. Declining changes nothing about the site.

    Cookie section

  • No sale of personal data

    Personal data is not sold. Calculator inputs run in your browser.

    Privacy Policy

Accessibility

WCAG 2.2 Level AA is the target. The honest status is partially conformant.

  • WCAG 2.2 AA target

    Keyboard navigation, visible focus, semantic landmarks, labelled forms, zoomable viewports and a skip link are in place. Some tools and diagrams do not fully meet AA yet and are listed as known limitations.

    Accessibility Statement

  • Accessibility checker

    Run an independent check on any page whenever you like.

    WAVE evaluation

Structured data and machine-readable discovery

Standards that help search engines and AI assistants read the site correctly.

  • Schema.org JSON-LD

    Person, Organization, WebSite, Article, FAQPage and BreadcrumbList markup. FAQ markup mirrors the visible questions on each page.

    Rich Results Test

  • Schema validator

    Validate the structured data against the schema.org vocabulary.

    Schema Markup Validator

  • Sitemaps and robots

    XML sitemaps list every public URL and robots.txt states crawl rules.

    sitemap.xml

  • llms.txt

    A plain-text index of the key hubs for AI assistants. It is a discovery file, not proof that any AI product cites the site.

    llms.txt

  • Identity file

    A machine-readable profile of the person behind the site.

    identity.json

Performance

No score is claimed here. Measure it yourself with the public tools.

  • Core Web Vitals and Lighthouse

    Run PageSpeed Insights on any page for lab and field data.

    PageSpeed Insights

What is not claimed

Formal certifications such as ISO 27001 or SOC 2 certify organizations and their processes, not a website. This site holds none and shows no seal for them.

  • No certification badges

    The standards above are practices you can verify, and they are labelled as such. None is a government seal, a passed audit or a third-party certification.

  • Personal credentials are separate

    Vatsal Shah’s professional certificates (150+) from AWS, Microsoft, Google, IBM and Meta are listed with issuer and year on the credentials page.

    Credentials

Found a problem? Report it to the contact page or use the address in security.txt.

Trust and standards: FAQ

What is in place, how to check it and what is not claimed.

Verify, do not trust
Does shahvatsal.com hold security certifications such as ISO 27001 or SOC 2?

No. Those certify organizations and their processes, not websites, and this site shows no seal for them. What it does have are practices anyone can verify: HTTPS with HSTS, browser security headers, consent-based analytics and published privacy and accessibility statements.

How can I verify the security headers and HTTPS setup?

Run the public scanners linked on the Trust page: SSL Labs for TLS, hstspreload.org for HSTS and Security Headers for the response headers. They test the live site, so the result does not depend on this page.

Is the site accessible and which standard does it follow?

WCAG 2.2 Level AA is the target and the current status is partially conformant. Keyboard navigation, visible focus, semantic landmarks and labelled forms are in place, and known limitations are listed in the accessibility statement.

How do I report a security problem?

Use the contact listed in the security.txt file at /.well-known/security.txt, or the contact form. Include the page address and what you found so it can be reproduced and fixed.

WhatsApp