1. Our security approach
eSora Studio is the creative-technology division of eSora Labs Ltd., and security thinking comes with that lineage. Our first control is architectural: this website is a static marketing and enquiry site. It has no user accounts, no authentication, no payment processing, no submission database, and no server-side application to exploit. The less a site holds, the less there is to lose.
2. What we do
- Minimal collection. The only personal information we receive arrives as ordinary email to info@esoralabs.com, a mailbox with access restricted to the people who handle it.
- Device-side storage only. The two browser-storage entries we use (consent record, quote draft) stay on the visitor’s device and are never transmitted to us.
- Encrypted delivery. The Site is served over HTTPS.
- Vetted dependencies. Third-party code is limited to widely used libraries served via established CDNs and font services, listed in the Privacy Policy; we assess new providers before adopting them.
- Care with correspondence. Client and enquiry materials are shared only with the people working on them, and confidential client materials are not submitted to external AI or other third-party services without approved arrangements (see Responsible AI).
3. What we do not claim
We do not publish security certifications, audit results, uptime guarantees, or specific infrastructure details we have not verified, and we do not describe controls that do not exist. If you need formal assurance information for a procurement or diligence process, ask us directly under NDA at info@esoralabs.com and we will provide what we can support.
4. Reporting a vulnerability
We welcome good-faith security research. If you believe you have found a vulnerability in this website, report it to info@esoralabs.com (attention: “Security”) with a description, the affected URL, steps to reproduce, and your contact details.
Ground rules. Test only against this website; do not access, alter, or exfiltrate data that is not yours; do not degrade service for others (no denial-of-service testing); do not social-engineer our staff; and give us a reasonable opportunity to investigate and fix the issue before public disclosure. Acting within these boundaries, we will not pursue legal action against good-faith researchers.
What to expect. A person reads every report and we acknowledge genuine reports as promptly as we reasonably can. We do not operate a bug-bounty programme and we do not promise a fixed response time — but we take real reports seriously and credit researchers who want to be credited.
5. Privacy breaches
Our approach to assessing and notifying privacy breaches — including PIPEDA’s real-risk-of-significant-harm threshold — is described in the Privacy Policy, section 12.
6. Contact
Security reports and questions: info@esoralabs.com (attention: “Security”). Please do not include exploit code in a first message beyond what is needed to demonstrate the issue.