Security and data protection

The short version

The smallest attack surface is the one that does not exist. This site is static files: no database, no user accounts, no sessions, no server-side application code, and no third-party scripts.

Most website compromises come through a CMS plugin, an outdated dependency executing on a server, or a third-party tag. None of those are present here. What is served is HTML, CSS, one JavaScript bundle and media, generated at build time and delivered from a CDN.

In transit

• HTTPS everywhere, with TLS 1.2 or better. Plain HTTP is redirected.
• HSTS, so browsers refuse to fall back to HTTP after a first visit. Set at the edge for two years, covering subdomains. TO CONFIRM: decide whether to submit the domain to the HSTS preload list — it is effectively irreversible, so it is a deliberate choice rather than a default
• Certificates are issued and renewed automatically by the hosting platform.

The application

• No server-side execution. There is no PHP, no application server and no admin interface to compromise.
• No database. The regulatory data is a flat CSV file generated from a reviewed source and served read-only. There is no query for anyone to inject into.
• No accounts. Nothing to log into, so no credentials to steal, stuff or phish against this site.
• No third-party scripts. No analytics, tag manager, chat widget, ad pixel or embedded player — so no supply-chain path in through someone else’s JavaScript.
• Dependencies are build-time only. They produce the output and do not run in front of visitors.

The data involved

There is very little, and that is deliberate.

Collected automatically

Server log entries created by the act of requesting a page — IP address, timestamp, path, status, user agent. Held by the host.

Collected from you

Only what you choose to send us by email. The lane you build in the planner stays in your browser until then.

Stored on your device

Nothing. No cookies, no local storage, no session storage — see cookie settings to verify it live.

Special category data

None is requested, and none should be sent to us through this website.

Organisational measures

• Enquiries reach a small number of named people and are handled on a need-to-know basis.
• Access to the hosting platform and the code repository is restricted to those who need it, protected by multi-factor authentication. TO CONFIRM: confirm MFA is enforced for all accounts on the hosting platform and the repository
• Changes to the site go through version control, so every change is attributable and reversible.
• Processors are engaged under Art. 28 GDPR agreements. TO CONFIRM: confirm the DPA with the hosting provider is signed and filed, and likewise for the email provider

If something goes wrong

A personal data breach that is likely to result in a risk to people’s rights is reported to Die Landesbeauftragte für den Datenschutz Niedersachsen within 72 hours of us becoming aware of it, as Art. 33 GDPR requires. Where the risk is high, we notify the people affected directly under Art. 34.

If you think you have found a vulnerability, please tell us before you tell anyone else — see responsible disclosure.

What this page covers

This describes the website. The security of a physical consignment — escorts, sealed handover, licensed magazines, documented chain of custody — is a different subject, dealt with in the service itself and in the terms and conditions.