I have built a custom subscription center using SSJS and AMPscript and I was wondering if, beyond the fact that it works, if it's up to security standards.
The center is just one cloud page which uses AMPscript if/else statements to load certain sections of the page based on a CloudPages() URL and user input on the form on the page. It shows the form on default, and when the submit button is pressed, after email validation, it loads a confirmation and redirect message on the same page, hiding the aforementioned form.
The form itself is basic. It asks for first + last name, email address, and then a bunch of check boxes for newsletters to sign up. I have IsEmailAddress() validating the email, and a RequestParameter() checking the email against the DE list. If the email doesn't exist, it prompts the user for a confirmation submit, and use an UpsertData() and DeleteData() to swap the emails in the DE and a InvokeUpdate() to update the subscriber status on the All Subscriber list. If the email does exist, the subscriber is prompted with our membership hotline for further assistance if required. It does not load information from the inputted email, only the one which was sent the original email.
I was just wondering if this is appropriate and safe for our organization, thank you!