Thanks for the heads up - We do use https all through the actual web app, but the server has the option to run http or https together. We are in the process of

Thanks for the heads up - We do use https all through the actual web app, but the server has the option to run http or https together. We are in the process of making it enforce https on all web app pages. The main page should link to only https pages on the web app so I will check it out again to ensure it does. I know the main page links to a documentation site and a blog, but those are running on two independent servers without https at this stage - we may add it later, but they are 'non critical' site that are purely informational and don't store any customer data. As for the sister site, yes that was a quick weekend build also running on a separate server. Seeing as that is a totally zero revenue site, I didn't want to spend any additional $$$ out of pocket at this early stage (though I may try out one of those free SSL certs that are becoming available now). If it proves to be useful in funnelling users to our main HR site then I will definitely beef up the security on that too.