← Home

As of 15.10.2026

Security and data protection

No tracking services, no cookies and nothing from third parties on the pages, encrypted connections, remote administration by key only, retention periods enforced automatically. Still open, among other things: a second factor at sign-in and an independent assessment.

The statements come from measurements on the live system (the date is given per line) or from the source code of the login services, which runs identically on the server. Where a statement comes from the privacy policy instead, that is noted. This page describes measures; it is not a legal assessment.

Measured on the live system

Connection
Encrypted with TLS 1.2 and 1.3; the server rejects TLS 1.0 and 1.1. Requests over HTTP are redirected to HTTPS. HSTS is set for two years, including subdomains. The certificate is issued by Let’s Encrypt and renews automatically. A DNS record (CAA) allows only Let’s Encrypt to issue certificates for the domain.measured on 14 Oct 2026
Browser protection
The server sends Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and a Content-Security-Policy. There is a caveat on the latter under “What is still open”.measured on 15 Oct 2026
Attack surface
Of 31 ports checked, these are reachable from outside: 22, 80, 443 (remote administration, redirect to HTTPS, HTTPS). The firewall is active. The web server version appears neither in response headers nor on error pages.measured on 14 Oct 2026
Remote administration
Key-based login only; password login is switched off. fail2ban blocks repeated failed attempts in five areas: remote administration, the web server’s sign-in, both form logins and request floods that trip the web server’s rate limit. Repeat offenders are blocked for longer each time, up to one week.measured on 15 Oct 2026
Updates
Security updates are installed automatically. No updates were pending at the time of measurement.measured on 14 Oct 2026
Retention
A daily run at 04:10 UTC deletes what has exceeded its retention period. The periods are set out in the privacy policy (in German), point 10.measured on 14 Oct 2026 (schedule and log)
Cookies
The pages set no cookies and load nothing from third parties when opened. Checked: home page, English version, imprint, privacy policy, Salon, the overview pages of the heat maps and a public city map. A cookie exists only after signing in to a protected area.measured on 14 Oct 2026
Monitoring
An hourly check verifies that every protected area still requires a password. A daily external check measures security headers, encryption (TLS 1.2 and 1.3 must work), the disclosure of server details and the certificate’s remaining lifetime. This page is checked too: the marked figures are compared with a fresh measurement every day and raise an alarm if they differ or the date of review gets too old.schedules and scope measured on 14 Oct 2026

Signing in to protected areas

Depending on the area, either a form login (customer sign-in for the heat maps, client area) or the web server’s HTTP basic authentication is used.

Form login
The session cookie carries the __Host- prefix and the attributes Secure, HttpOnly and SameSite=Strict, and contains only a random identifier. Passwords are stored as a bcrypt hash (cost factor 12); if someone sets their own password, the operator does not know it. Invitation links are valid for 72 hours, at most 14 days, can be used once and are stored only as a checksum.source code, identical on the server
Session
The cookie ends when the browser is closed. After a period of inactivity the session expires. Sessions are held in memory only: a service restart signs everyone out.source code, identical on the server
Against guessing
Failed attempts are counted per address and per account and lead to a temporary block. Every check takes the same minimum time, so the response time does not reveal whether an account exists.source code, identical on the server
Account expiry
Customer accounts can carry an expiry date; no expiry is a deliberate individual decision.source code, identical on the server
Basic authentication
With basic authentication too, passwords are stored only as bcrypt hashes.measured on 14 Oct 2026

Who else sees data

Hosting
Hetzner Online GmbH, servers in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.privacy policy, point 2
Map services
The map data sits on the site’s own server. Connections to third parties arise only when someone uses the address search (Nominatim of the OpenStreetMap Foundation) or switches on an aerial-imagery layer; the service concerned then sees the IP address. The site’s security policy allows ten geodata services for this: geoservices.bayern.de, gdi.berlin.de, www.wms.nrw.de, owsproxy.lgl-bw.de, www.gds-srv.hessen.de, geo4.service24.rlp.de, isk.geobasis-bb.de, opendata.lgln.niedersachsen.de, wms.geo.admin.ch (Switzerland) and gis.tirol.gv.at (Tyrol).security policy measured on 14 Oct 2026; behaviour as per privacy policy, point 6
Email
Incoming mail for kontakt@julianzuber.de is routed, per the DNS records, through the forwarding service ImprovMX (ImprovMX Incorporated, USA). According to the provider, incoming messages are stored only transiently in France and deleted after delivery; delivery runs over infrastructure in France and in the USA.MX records measured on 14 Oct 2026; provider statements; privacy policy, point 8

What is still open

Second factor
Neither the form login nor basic authentication has a second factor.source code and measurement
Content security policy
On the sign-in pages (customer login and client area), inline scripts have run since 15 Oct 2026 only with a nonce that is generated afresh on every request; the browser blocks an injected script. For all other pages and for stylesheets, the Content-Security-Policy still allows 'unsafe-inline'. The risk there is limited because those pages are generated statically from a versioned source; hardening with hashes is pending.source code and measurement on 15 Oct 2026; self-test of 13 Sep 2026
Independent testing
So far there is only a self-test from 13 September 2026, carried out with knowledge of the set-up: no blind test and no third-party assessment. A commissioned penetration test would be the next step.report of 13 Sep 2026
Domain
The domain is not DNSSEC-signed. The DMARC record is set to monitoring (p=none), not to reject.measured on 14 Oct 2026
Further details
I provide further open points and the technical and organisational measures in detail to data protection officers on request at kontakt@julianzuber.de.not public

Check it yourself

Three things can be checked without any access:

Questions and reports

Questions from data protection officers and reports of vulnerabilities, please to kontakt@julianzuber.de. How reports are welcome is described in the security.txt. Legal texts: imprint and privacy policy.