SHAHZAD AND RAINER

Governance

How the group governs itself.

A small group is only as credible as the rules it can show you. These are ours: which entity operates which domain, what the sites are checked against before they are published, and what the group will not print.

Open the legal centreContact the partnership

Verified at build time

Operating entities
FourAll named in the legal centre.
Domains under one centre
Eight
Legal documents
SixEach naming every domain it applies to.
Accessibility standard
WCAG 2.2 level AAChecked before a page can be written.
Third party requests
NoneNo font, script, icon or analytics call leaves the group's own servers.
Security headers per response
Seven

Structure

Which entity operates which domain.

Shahzad and Rainer, LLC is the holding partnership. Four entities operate the eight domains the group runs. This table is generated from a single list in the build and is printed identically on all seven pages of the legal centre, so a domain cannot be covered in one place and missing in another.

Sites these documents apply to
DomainSiteOperated by
rainerandshahzad.comThe partnershipShahzad and Rainer, LLC
shahzadandrainer.comThe partnershipShahzad and Rainer, LLC
raineragency.comRainer AgencyRainer Agency, Ltd
hashtagcodes.comHashtag Dialing CodesHashtag Dialing Codes, LLC
poundcodes.comPound CodesHashtag Dialing Codes, LLC
poundcodesusa.comPound Codes USAHashtag Dialing Codes, LLC
raineragency.orgRainer PhilanthropiesRainer Philanthropies, Inc.
hotlinedirectory.orgThe Hotline DirectoryRainer Philanthropies, Inc.
aftericu.orgAfter the ICURainer Philanthropies, Inc.

Three of the six nonprofit initiatives do not have a domain on this list yet. They are named on the impact page, with their coverage status stated beside them. Until a domain appears above, the documents in the legal centre do not govern it, and the group will not claim otherwise.

Build standards

Six rules, all of them checked rather than asserted.

Every rule below is enforced by the build that produced this page. A site that fails any of them does not ship. That is a stronger promise than an annual audit, because it applies to every page on every deployment.

01

One legal centre, every domain

Six documents cover eight domains. Each document lists the domains it applies to. The list is held once in the build and printed on every legal page, so a domain cannot be covered on one page and missing on another.

  • Replaced a centre that named three domains
  • Replaced five sites carrying another organisation's policy
02

No third party requests

No web font, no icon library, no analytics beacon and no chat widget is loaded from anybody else's server. A visitor's address is not disclosed to a third party before they have agreed to anything, and no render blocking request goes to a host the group does not control.

  • Every page opens correctly with no network
  • Content Security Policy of default-src 'self'
03

Accessibility verified at build time

The group builds to the Web Content Accessibility Guidelines version 2.2, level AA. Colour contrast for every text pair in the palette, one main heading per page, heading order, text alternatives for images and keyboard reachable navigation are all checked before a page can be written.

  • A page that fails does not ship
  • Checked again in a real browser at three viewports
04

Every link resolves before publication

Every root relative link and every in page anchor is resolved against the pages the build actually produced. Links to domains known to be dead are rejected by name, because four of them were still being linked across the estate.

  • No link to a page that does not exist
  • No anchor without a matching heading
05

One number, one address

The build rejects a site that publishes more than one contact telephone number, and it rejects an email address whose visible label does not match the address it links to. Both defects were found on live sites in this group before the rebuild.

  • One published number per site
  • Label and link must agree
06

Nothing that looks like a credential

Page source is scanned for anything shaped like a password, an API key or a bearer token before it can be published. This check exists because a live public page in this group once listed ten accounts in plain text.

  • Scanned on every page, every build
  • The rule that produced it is not being repeated

Publication rules

What the group will not print.

These are the rules a reader can hold us to. Each one has cost us a sentence we would have liked to write.

A figure our own records state more than one way

Nothing is printed until one figure has been confirmed and dated. The size of the hotline directory is the open example: four different numbers across our own properties, so no number anywhere on this site.

An award year two of our sites give differently

The award is named without a year. The Marquis Who's Who entry on the Robert K. Rainer profile is named that way for exactly this reason.

A testimonial we cannot trace

No client comment is published unless it can be traced back to the person who gave it. That is why this site carries named credentials rather than quotations from anonymous clients.

A legal document written for another organisation

Three sites in this group published another organisation's privacy policy. One centre now covers all eight domains, and no individual site writes its own.

A standard we have not checked

The accessibility statement names what has been verified and what has not. Sites still on the previous platform are named as not yet checked rather than quietly included.

A fact with no source

Every biographical fact, credential and quotation on this site comes from the partnership's own record. Where a claim had no source, it was removed rather than softened.

Security

How the group's sites are served.

Seven security headers on every response, on every site in the group, generated from one configuration file so that a header added once is added everywhere.

Content Security Policy
default-src 'self'. No inline script and no inline style is permitted on any page, which is why nothing in this group uses a style attribute.
Strict Transport Security
One year, including subdomains, with preload.
X-Content-Type-Options
nosniff. A file is treated as the type it was served as.
Referrer-Policy
strict-origin-when-cross-origin. A full path is never sent to another site.
X-Frame-Options
DENY. These pages cannot be framed by anybody else's site.
Permissions-Policy
Camera, microphone, geolocation and interest cohort are all denied outright.
Cross-Origin-Opener-Policy
same-origin. A window the group opens cannot reach back into the page that opened it.

The policy is this strict because the group loads nothing from anybody else. A site that embeds a third party font or analytics script has to weaken its policy to allow it, and that exception is then permanent. There is no exception here to keep track of.

Every document, in one place.

Privacy, terms, disclaimers, accessibility, cookies and California rights, covering all eight domains.

Open the legal centreContact the partnership