How this site handles security, privacy, and your data.
This page is maintained by Zack Farris to answer common security and privacy questions about zackfarris.com — the personal site and investor materials, not the LendlyX product. It describes controls that are actually in place today. It is not a certification or an audit report.
Last updated June 20, 2026.
What is enabled today.
Encryption in transit
All traffic to zackfarris.com is served over HTTPS with TLS terminated at the edge. Form submissions and API requests are encrypted end-to-end between your browser and the application.
Row-level security on stored data
Contact submissions and access-code records live in a managed Postgres database with row-level security enabled. Application code reads and writes through narrowly scoped policies; no public read access is granted on submission tables.
Signed, timing-safe webhook auth
Internal webhooks (e.g. press refresh) require a server-side secret and use a timing-safe comparison. Unauthenticated or malformed requests are rejected with a 401 and a structured audit log entry — never with secret material in the response.
Structured security logging
Authentication failures on protected endpoints emit single-line JSON events with route, reason, client metadata, and a SHA-256 fingerprint of any submitted credential. The underlying secret value is never logged.
Server-side validation
Server functions validate inputs with schema parsers before any database write. Privileged operations run on the server only — the browser bundle never sees service-role credentials.
Gated investor materials
The signed APA referenced on the investor page is not public. It is served only after a one-time access code is issued to a verified email and exchanged for a short-lived, signed token.
What this site collects, and why.
Only what is needed for the conversation you started — nothing assembled into a marketing profile.
- Contact form submissions
- Name, email, and the message you send. Stored so Zack can reply and keep a record of the conversation.
- APA access-code requests
- Email address and the issued access code. Used solely to gate the APA preview for verified investors.
- Basic request logs
- Standard server and edge logs (timestamp, route, status, coarse client metadata). Used for reliability and abuse investigation. No third-party tracking pixels or marketing analytics are loaded.
You can request deletion of any record tied to your email by writing to privacy@zackfarris.com. Requests are honored within a reasonable period and confirmed by reply.
Who helps operate this site.
- Managed cloud hosting
Application hosting, Postgres database, authentication, storage, and edge runtime for server functions.
- AI model gateway
Routing for any AI-assisted features on the site. No investor or contact data is sent to AI providers as part of normal browsing.
- Transactional email provider
Delivery of contact replies and APA access codes. Email addresses pass through the provider only as needed to deliver the message.
What should never happen here.
- Selling, renting, or sharing your contact details with marketers.
- Storing the APA, investor materials, or credentials in client-side storage.
- Embedding third-party advertising or behavioral tracking on this site.
- Returning secret values, tokens, or database identifiers in error responses.
Note on scope: LendlyX is a separate company with its own security program, customer agreements, and subprocessor list. Statements on this page describe the personal site at zackfarris.com only.
Independent ways to verify the work.
Investor materials are organized so nothing has to be taken on trust. Each claim links out to a third-party source or to a gated document you can review yourself.
Found something? Tell us.
Report suspected vulnerabilities, request data deletion, or ask a privacy question. We acknowledge reports promptly and do not pursue good-faith security research.
privacy@zackfarris.com