Production domain and TLS certificate configured.
Backend secrets stored outside source code.
CRM/LIMS API credentials restricted by least privilege.
Form validation, spam protection and rate limits enabled.
Authentication and authorisation penetration-tested.
Backups configured and restore procedure tested.
Error monitoring, uptime monitoring and alerting active.
Privacy notice, terms and retention policy approved.
Audit logs retained and access-controlled.
Incident response contacts and escalation process defined.
