Last updated: 11 July 2026.
I Love Supply Chain is designed as a lightweight, browser-based tool website. Our security approach begins with data minimisation: the calculators do not require an account, password, subscription or personal profile, and routine calculations are performed in the visitor's browser wherever practical. This reduces the amount of information transmitted to the website and limits the consequences of a security incident.
1. Security by design
The website is built as a static HTML, CSS and JavaScript application with a small optional server endpoint for aggregate visitor counts, calculator voting and suggestions. We deliberately avoid unnecessary frameworks, third-party plug-ins and complex account systems. Fewer moving parts reduce the number of components that can become outdated or misconfigured. Security is considered during design, testing and release preparation rather than being treated as a final add-on.
Calculator inputs are intended to remain within the browser. The website does not intentionally transmit the dimensions, quantities, costs, stock figures or other calculation values entered into calculator fields to the engagement endpoint. Users should nevertheless avoid entering confidential trade secrets, personal data or information subject to contractual restrictions into any online tool unless they have independently confirmed that doing so is permitted by their organisation.
2. HTTPS and transport protection
When the website is deployed on its official domain, it should be served exclusively over HTTPS using a valid TLS certificate. HTTPS encrypts information exchanged between the visitor's browser and the web server while it is in transit and helps the browser verify that it is communicating with the intended domain. Visitors should confirm that the address bar displays the official domain and a secure connection indicator before submitting suggestions or other information.
Transport encryption does not guarantee that a device, browser, local network or third-party service is secure. Visitors remain responsible for maintaining their own devices, applying operating-system and browser updates, using reputable security software where appropriate, and avoiding untrusted networks.
3. No accounts and no passwords
I Love Supply Chain does not require user registration. We therefore do not store user passwords, password-reset tokens, profile photographs, account recovery answers or authentication histories. Removing these account-related data classes materially reduces exposure to credential theft, credential stuffing and unauthorised account access.
The absence of an account also means that browser-based preferences, votes or cooldown indicators may not transfer between devices or browsers. Clearing local browser storage may remove those local settings. This is a usability trade-off chosen to preserve privacy and reduce infrastructure complexity.
4. Optional engagement service
The optional engagement service records aggregate visits, calculator votes and suggestions. It is intentionally limited in scope. A visit may be counted once per browser session by the front-end script. Upvotes and downvotes are associated with a calculator identifier rather than a named person. Suggestions may include the text voluntarily submitted and the relevant calculator identifier.
The application does not deliberately store a name, email address, telephone number or postal address through the standard suggestion form. Server infrastructure and hosting providers may generate routine technical logs, such as timestamps, requested paths, IP addresses, user-agent strings or error records, as part of normal operations. Those logs should be protected, retained only as long as reasonably necessary for security and operations, and handled in accordance with the Privacy Policy.
5. Input handling and application safeguards
Calculator fields use type, range and validation controls to reject invalid values and reduce calculation errors. Feedback text submitted to the server is stripped of HTML markup and length-limited before storage. Calculator and page identifiers are restricted to expected characters. Data files used by the optional PHP endpoint are stored outside public directory listing where hosting configuration supports it, and direct access should be restricted by server rules.
No security control is perfect. Input validation improves resilience but does not replace secure hosting configuration, file permissions, regular backups and server maintenance. The site owner should ensure that PHP, the web server and the operating system are supported and patched.
6. Third-party services
The core website is designed to function without advertising, analytics or external content libraries. If advertising, referral services, analytics or payment services are introduced later, each third party will have its own systems and security practices. Such integrations should be reviewed before activation, disclosed in the Privacy and Cookie Policies, loaded only where necessary and configured to collect no more information than required.
Links to external websites do not mean that I Love Supply Chain controls or guarantees those websites. Visitors should review the security and privacy information of any external provider before sharing information or completing a transaction.
7. Secure development and release controls
Releases are subject to checks for broken links, missing assets, JavaScript syntax errors, calculator test cases, duplicate metadata and obvious unsafe coding patterns. Calculator formulas are independently checked against known examples before release. These quality controls reduce the likelihood of defects but do not create a warranty that every page will always be free of vulnerabilities or errors.
Changes should be versioned and documented. Backups of the production package and engagement data should be maintained. Access to hosting, domain registration, DNS and deployment systems should be limited to authorised persons, protected by strong unique passwords and multi-factor authentication where available.
8. Availability, backups and recovery
Static calculator pages can remain usable even when the optional engagement endpoint is unavailable. The visitor counter, voting and suggestion functions are designed to fail without preventing calculations. This separation improves resilience and limits the impact of a server-side service interruption.
Reasonable backups should be maintained for the website files and engagement data. Recovery procedures should be tested periodically. Temporary outages may still occur because of hosting failures, maintenance, denial-of-service activity, certificate problems, DNS issues or events outside the site owner's control.
9. Responsible disclosure
If you believe you have identified a security vulnerability affecting I Love Supply Chain, please use the Contact page and select the security or technical issue option. Provide a clear description, the affected page or endpoint, steps to reproduce the issue and any evidence that can be shared safely. Do not include passwords, personal data belonging to another person, malicious code intended to cause damage or confidential information obtained without authorisation.
Please act in good faith, avoid accessing or modifying information that is not yours, do not disrupt availability, do not conduct social-engineering attacks and allow a reasonable period for investigation before public disclosure. We will review credible reports and prioritise fixes according to severity and practical risk. We do not operate a paid bug-bounty programme unless expressly announced in writing.
10. User responsibilities
Users must not attempt to bypass security controls, overload the website, automate abusive requests, introduce malware, probe systems without permission or use the website for unlawful purposes. Users are responsible for verifying calculator outputs before operational use and for ensuring that their use complies with internal policies, contracts, applicable laws and professional obligations.
11. Security limitations
No website, network or storage system can be guaranteed completely secure. Security threats evolve, hosting environments differ and users may access the website through compromised devices or networks. The measures described on this page represent a practical risk-reduction approach for a lightweight tool platform; they are not an absolute guarantee against interception, loss, alteration, unauthorised access or service interruption.
For information about personal information, browser storage and optional feedback data, read the Privacy Policy and Cookie Policy. For restrictions on use and liability, read the Terms & Conditions and Disclaimer.