01
Validated requests
The form endpoint accepts JSON from the same website, rejects unknown fields and cross-site requests, limits request size, and validates required field formats.
SECURITY & TRUST
Clear about what is protected today.
This page describes the controls that protect Lenswork workspaces, the website and its contact forms today. It lists only what is in place now.
Separate data for each workspace Role-based access
CURRENT CONTACT FLOW Website forms
01Same-origin form submission
02Server-side validation
03Approved fields sent to TruthyLink
CURRENT WEBSITE CONTROLS
Practical protections around each request.
These statements describe the website code and request flow that exist today.
02
Server-only credential
The TruthyLink API credential is read from the server environment. It is not included in the browser form or public website files.
03
Conservative responses
Form responses are marked private and not stored in browser caches. Success appears only after TruthyLink confirms that the contact record was accepted.
WORKSPACES AND WEBSITE
Controls in place today.
Sign-in and your business records live in Lenswork workspaces at app.lenswork.in. Payments are handled by Razorpay.
Separate workspaces
Each business’s records are kept in their own separate database area, so one workspace cannot read another’s data.
Roles, sign-in limits and audit log
Owners choose what each team member can see and do. Repeated failed sign-ins are slowed down, passwords are stored only as secure hashes, and sign-ins and important changes are recorded in the workspace audit log.
Hosting and request data
The website runs as a Cloudflare Worker through its managed hosting project. The hosting environment may process technical request information for delivery, access, security and operational visibility. Exact log fields and retention are not stated here.
Contact form processing
Validated enquiry and demo details are sent server-to-server to TruthyLink, which processes and stores the contact record for Lenswork. A specific retention period and deletion process have not yet been published.
Locally hosted fonts
The website serves fonts from its own domain, without sending visitors to an external font service.
Not yet publishedEncryption at rest, storage location, backup schedules, certifications and incident-response commitments will be added here once they are confirmed.
UNDERSTAND YOUR DATA
See how contact details are used.
Read the current website Privacy Notice or use the Contact page for a data-related enquiry.