A company that builds sovereign security infrastructure should hold its own site to the standard it asks of others. Everything below can be checked with public tools.
Transport
TLS
TLS 1.3 only, with HSTS and preload.
Protocol
HTTP/3, with OCSP stapling.
Domain and DNS
DNSSEC
The domain is DNSSEC-signed.
Issuance
CAA records restrict which authorities may issue certificates. No wildcard.
Application
Content-Security-Policy
Strict, with no unsafe-inline and frames denied.
Isolation
Cross-origin isolation headers set; permissions for camera, microphone, and geolocation denied.
Mail
Authentication
SPF (hard fail), 2048-bit DKIM, and DMARC at reject with reporting.
Transport
MTA-STS and TLS reporting enabled.
Disclosure
security.txt
An RFC 9116 security.txt, signed with the SIGIL PGP key.
Policy
A coordinated-disclosure policy with a safe-harbour statement; info@sigilsovereign.com is monitored.
Supply chain
Bill of materials
This site's software bill of materials and build provenance are published per release.
Signing
Builds are signed; what runs can be checked against what was shipped.
Privacy
No cookies
This site sets no cookies and loads no third-party scripts.
Analytics
Server-side log analysis only; no client-side tracking.
PGP key
Encrypted correspondence and signature verification use the SIGIL PGP key.
Fingerprint
C1C4 A87F EB43 04DB 9E62 86A1 F013 6C58 BB19 5F0C
The full public key is published at /pgp.txt. Verify the fingerprint before use.