What is in place
The site is served only over HTTPS, with HTTP Strict Transport Security. It is a set of static files: there is no database, no login, no user content and no server-side application to attack. A Content Security Policy restricts the page to resources served from this domain, so an injected third-party script cannot execute.
The site sits behind Cloudflare, which terminates TLS at the edge, absorbs attack traffic and can challenge suspicious connections. Responses carry the usual protective headers against content-type sniffing and framing.
The company mailbox is ordinary business email. Treat anything you send by email as readable in transit, and do not use it for material that needs protected transfer.
What we do not claim
We do not publish a retention schedule, a certified information-security management system, a penetration-test history, an incident-response time or a backup and restore guarantee, because the company is at construction stage and has not yet established or evidenced them. This page will describe them when it can.
If you believe you have found a security problem with this website, write to info@luangpharma.com with enough detail to reproduce it.