Read me first
The one rule that governs everything
Build proceeds now. The site does not go public until the Go-Live Gate is cleared and Themis signs off against the live build. Nothing in this pack blocks you from building — the constraint is on going public, not on building.
The copy on the site is immutable: it is Themis-approved Tier-1 wording (verbatim from WD-0001). Any wording change re-triggers legal sign-off, so treat all visible text as locked content — build it as discrete, swappable copy blocks but do not paraphrase. Real-world facts that aren't known yet render as visible [bracketed placeholders]; each is wired as a one-line swap (see Outstanding facts).
Two source documents rule the build. legal/IN-0001 is the master worklist + Go-Live Gate — build against it top to bottom. legal/WD-0001 holds the exact copy to paste. This pack is the map; those two are the authority.
Visual tour
What you're building
A single-page marketing site (seven sections) plus a policies page that splits into five routes in production. Light/dark theme toggle, keyboard-and-screen-reader accessible (WCAG 2.2 AA), no cookies, no analytics. Screens below are from the approved reference build.
/privacy /cookies /terms /accessibility /modern-slavery. Verbatim WD-0001 copy; highlighted brackets are facts to supply.What's in the pack
File map
| File | What it is | For |
|---|---|---|
| CyberSight Website.html | The design reference — fully interactive. Build the production site to match this. | Engineering |
| CyberSight Policies.html | The five policy pages (verbatim approved copy). Ship as separate routes. | Engineering |
| Facts Pack Request.md | Fill-in sheet for every outstanding real-world fact. | Principal |
| Form Backend Build Brief.md | Enquiry capture → database → WhatsApp architecture + SP-0001 compliance map. | Engineering |
| legal/IN-0001 | Master worklist + Go-Live Gate. Build against this. | Engineering |
| legal/WD-0001 | Approved verbatim copy (D-1→D-9). Paste exactly. | Engineering |
| legal/SP-0001 | Legal requirements for the form backend (the brief above implements these). | Engineering |
| audits/Site Audit | Security, bugs, SEO, performance, responsive, UK-legal review. Baseline CSP here. | Engineering |
| audits/WCAG Audit | Accessibility audit + contrast table. Non-negotiables to preserve. | Engineering |
| brand/Brand Guidelines | Colour, type, logo usage rules. | Engineering / design |
| exports/ | Logo marks (SVG + PNG, all variants); favicon; OG image. | Engineering |
Do not ship tweaks-panel.jsx or #tweaks-root. That's design-review tooling only — strip it from the production build (see Build notes).
Design system at a glance
Tokens & type
Full rules live in Brand Guidelines. The essentials:
Colour
Amber is the single accent — used sparingly for kickers, the evidence-card icon, and primary emphasis. Navy-bright is the focus-ring colour (3px, 2px offset).
Type
All three are SIL Open Font Licence — self-host WOFF2 subsets with font-display: swap for production (don't ship the Google Fonts CDN link).
Logo
Site uses cybersight-mark-scan-reversed.svg on dark grounds and cybersight-mark-scan-badge.png as favicon. The wordmark is live text (Space Grotesk 500, 0.12em tracking), not an image. focus/sight mark variants are alternates, not used on the site.
Build notes
Engineering checklist
Full detail in Site Audit and IN-0001. The headline tasks:
| Task | Detail | Flag |
|---|---|---|
| Strip review tooling | Remove the Tweaks panel scripts + #tweaks-root — must not ship. | Required |
| Self-host fonts | WOFF2 subsets, font-display: swap; drop the CDN link. | Required |
| Form backend | Build to the Form Backend Build Brief + SP-0001. Report back the four/five items. | Blocker |
| Security headers | CSP, HSTS max-age=31536000; includeSubDomains; preload, nosniff, X-Frame-Options: DENY, Permissions-Policy. Baseline CSP in the audit. | Required |
| Policy routes | Split the policies file into /privacy /cookies /terms /accessibility /modern-slavery; wire the footer links (currently #). | Blocker |
| OG image + JSON-LD | Create og-image.png (1200×630); extend JSON-LD address + sameAs once known. | Required |
| Real URLs | Canonical domain; real social URLs with rel="noopener noreferrer". | Required |
| Welsh "coming soon" | The language picker must not 404 on a Welsh selection — wire the WD-0001 D-8 holding state. | Advised |
| Pen-test + live review | Commission a penetration test; audits are advisory. Themis re-checks the live build. | Advised |
Accessibility is non-negotiable (WCAG 2.2 AA met). Preserve: skip-to-content link, landmark structure + single h1, 3px focus-visible rings (2px offset), explicit image width/height, form label[for] + aria-describedby hints + role="status" confirmation, prefers-reduced-motion, ≥44px touch targets, 16px min input font. Detail in the WCAG audit.
Form & data
Enquiry capture → database → WhatsApp
The enquiry form stores submissions in a database and alerts the team on WhatsApp. The full spec — schema, API contract, security, retention and the SP-0001 compliance map — is in the Form Backend Build Brief. The architecture:
The key decision: a PII-free WhatsApp alert
WhatsApp/Meta sits outside the UK/EEA. The alert carries no enquirer personal data — just "new enquiry + timestamp + reference id". Staff open the authenticated console to read it. This keeps all enquiry PII in the UK/EEA store and keeps Meta out of the enquiry-data chain (no extra transfer mechanism needed).
Recipients are staff, not the enquirer
The notification goes to CyberSight's own staff number(s) — the enquirer is never messaged on WhatsApp. The send is best-effort and decoupled: if WhatsApp fails, the enquiry still stores and is picked up in the console. Never block capture on a notification, never put PII in a retry payload or log.
Hard gate (SP-1): the form must not store or send anything until the Privacy Policy is live and linked. Build capture disabled-by-default and gate it on that. Providers (form/email, hosting, DB, WhatsApp) each need UK/EEA residency + an Art 28 contract on file before use — the form/email and hosting names then fill the brackets in the Privacy Policy (WD-0001 D-3).
Go-Live Gate
All must be true before public launch
From IN-0001. Blocker = hard gate. Return completed items to Themis quoting the item numbers; Themis re-checks the rendered live build before sign-off.
Blockers (hard gate)
- 1Footer shows the currently-registered company name + number 15312330 + registered office + England & Wales.
- 2ICO line shows ZC098139.
- 3Privacy Policy live and linked before any enquiry capture is enabled.
- 4All uncertified certification badges removed; only held certs shown (with register link); "Working towards" text-only line in place.
- 5Service-level claims revised and the company holds the substantiating evidence.
- 6Emergency-response wording qualified in all four locations (stats strip, process step 01, contact line, FAQs 1 & 5).
- 7Forensic-standards claims at Tier-1; no "court-ready" / badges / expert-witness-as-capability.
- 8Themis sign-off against the live build recorded.
Required at/before launch
VAT line resolved · form backend meets SP-0001 · Cookie Policy live · Terms live · gov-affiliation disclaimer site-wide.
Advised
Accessibility statement (audit-dated) · Modern Slavery decision · Welsh "coming soon" state · trade-mark clearance · "Website by" credit confirmed.
Outstanding facts
What the Principal still owes
These render as visible [placeholders] today and each swaps in as a one-line config/content change. The full fill-in sheet is the Facts Pack Request — please complete and return it so nothing is missed at the gate.
| Fact | Status |
|---|---|
| Registered office address | Resolved 12 Jun |
| Company no. 15312330 · ICO ZC098139 | In build |
| Company rename status (Companies House) | Gate |
| VAT number or "not registered" | Gate |
Site contact email (confirm support@cybersightforensics.com) | Needed |
| Certifications actually held (numbers + dates) | Gate |
| Evidence for each SLA target | Gate |
| FSR activities · ISO 17025 / CREST / NCSC status | Gate |
| Form/email + hosting providers (+ residency, Art 28) | Gate · Eng |
| WhatsApp recipient number(s) + approve PII-free design | Needed |
| Retention period (confirm 12 months) | Gate |
| Canonical domain · go-live date · social URLs | Needed |
| Modern Slavery keep/remove · "Website by" credit · Welsh obligation · trade-mark | Decisions |