Proof
We run our own tools on ourselves.
A security firm’s own website is the first audit a prospect runs. So we point Resolute’s own scanners at resolute-security.com and hold ourselves to the standard we would hold you to. Below is our posture, and exactly how you can confirm it yourself. Do not take our word for any of it.
Control
Email spoofing
Our posture
SPF set to hard-fail and DMARC set to reject. In record terms, -all and p=reject. Mail that spoofs our domain is rejected outright, not quietly delivered. That is the strongest posture the standard allows.
How you verify
Run our free email scan, or check our records in any DMARC lookup tool.
Control
Transport security
Our posture
Every visit is forced to HTTPS and pinned with HSTS, max-age=31536000; includeSubDomains. There is no unencrypted path to the site.
How you verify
Run our free web scan, or test the certificate with SSL Labs.
Control
Response headers
Our posture
Clickjacking, MIME-sniffing, referrer leakage, and browser-feature abuse are blocked by enforced headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. A Content Security Policy runs in report-only mode while we finalize the allow-list for our embedded forms.
How you verify
Check our headers with Mozilla Observatory, or read them in your browser dev tools.
Control
Software disclosure
Our posture
The platform and version behind the site are not advertised, so an attacker cannot shop our stack for known issues.
How you verify
View the page source. The usual version and generator tags are gone.
We hold ourselves to the standard we will hold your business to.
Or run the same free scans we run for clients: email security · web security
Last reviewed June 2026. We re-check on a regular schedule.