Most attacks on a company start with a convincing message from someone pretending to be a supplier. This page exists so anyone working with PerrfectSite can check, in a few seconds, whether a message is real.
Read it once. Bookmark it. Send it to whoever handles payments at your company.
Verified channels
Every legitimate contact from PerrfectSite comes from one of these.
| Purpose | Verified address or domain |
|---|---|
| Websites | perrfect.site, perrfectsite.uk, perrfectsite.ro, perrfectsite.hu |
| Shared & official mailboxes | [email protected], [email protected] |
| Leadership | [email protected] |
| Team members | [email protected] |
| Credential sharing | 1Password shared vaults, invited from a verified address above |
| Environment secrets | Infisical, granted per person against a named account |
Only two shared mailboxes exist. There is no support address, no accounts address, and no security address at any PerrfectSite domain. A message from something like support@ or billing@ is fraudulent regardless of how convincing the rest of it looks.
Anything outside the list above is not PerrfectSite. That includes free mailbox providers, look-alike spellings such as perrfect-team.com or perfect.site with a single r, and any domain that resembles a real one closely enough to make you look twice.
What PerrfectSite will never do
- Never ask for credentials the project brief does not call for. Some work genuinely requires access to a system, and in those cases the request maps to the agreed scope and the credentials move through a 1Password vault rather than email, chat, or a phone call.
- Never ask for a two-factor code or a recovery phrase. No project needs either one, whatever the brief says.
- Never send new bank details by email. Payment details change through a signed document and a verbal confirmation on a number you already have.
- Never request payment in cryptocurrency or gift cards.
- Never pressure a decision with urgency. A real request survives a five-minute pause while you verify it.
- Never ask staff at your company to bypass a control that was put in place on purpose.
If a message claims to come from PerrfectSite and breaks any of these, treat it as hostile and forward it to [email protected].
Verifying a message
Check the full sending address rather than the display name. Display names are trivial to fake. The address after the @ is what matters.
Hover a link before clicking it and read the domain. Where a message asks for money, access, or a change to existing arrangements, confirm through a channel you already trust rather than by replying.
How the team works
Security runs as a set of standing practices rather than a policy document nobody opens. The five areas below cover how devices, accounts, and access are handled day to day, and they follow the technical controls published by the UK National Cyber Security Centre.
Firewalls. Every company device runs a configured host firewall. Remote work runs through a company VPN, so client systems are never reached from an unsecured network.
Secure configuration. Work happens on company-managed computers rather than personal machines. Default accounts and unused services are removed during setup, disk encryption is on, and screens lock automatically.
Security update management. Operating systems and applications receive updates on a defined schedule, with high-risk fixes applied promptly. Software no longer supported by its vendor gets removed rather than tolerated.
User access control. Each person holds their own named account with the minimum access their role requires. Passwords are generated and stored in 1Password, never reused, and never shared over chat or email. Application secrets and environment variables live in Infisical, separated by environment and access-controlled per person. Access is reviewed when a role changes and revoked the day someone leaves.
Malware protection. Company devices run active malware protection, and software is installed from approved sources rather than wherever a search result leads.
Contractors and confidentiality
Not every project runs on the core team alone. Specialists get brought in where a brief calls for a skill the team does not hold, and that arrangement carries the same rules rather than a relaxed version of them.
The same security policy applies. Contractors work under the controls described above. Named accounts with the minimum permissions the task requires, credentials issued through 1Password, environment secrets through Infisical, and no client data on personal tooling. Access is scoped to a single project and revoked when the engagement ends.
Checks come before access. Identity and prior work are verified before a contractor touches anything belonging to a client. The security policy is signed rather than emailed and forgotten, and access is granted for what the task needs instead of what would be convenient.
Everyone signs an NDA. Non-disclosure agreements are in place for every employee and every contractor, with no exceptions and no verbal arrangements. Signing happens before access is granted, not once work is already underway. The obligations continue after the engagement ends, so someone who finished a project two years ago remains bound by the same terms.
Where a client needs a direct NDA with a named individual, or requires their own agreement rather than the standard one, that gets arranged before the work starts.
Working with client systems
Client credentials go into a dedicated vault, not into a project document or a chat thread. Where a client can create a named account instead of sharing an existing login, that is the preferred route, because access can then be revoked without disrupting anyone else.
At the end of a project, access is returned or removed on request. Ask for it in writing and it gets done.
Reporting something suspicious
Send anything that looks wrong to [email protected], including messages that turned out to be harmless. A false alarm costs a minute. A missed one costs considerably more.
If you have already clicked a link or entered credentials, report it anyway and change the password immediately. Speed matters more than embarrassment, and nobody at PerrfectSite treats a report as a mistake.