Static HTML, yeah.

Not sure about VPN. Seems likely to provide a false sense of security.

I think they mean VPN as in WireGuard where each customer would have a separate private network to the service provider. This way the service wouldn't be exposed to the public Internet.

	▲	hdgvhicv a day ago \| parent [-]
		MTLS would do the job, but you still just need one compromised customer.