Security

Last updated: 11 October 2026

Security

• Automated Backups & Disaster Recovery: An encrypted, password-protected backup of the application, database, and server is stored in a separate location from the main server to ensure fast recovery in the event of hardware failure or operational issues. Backups are automatically generated in the background every 24 hours and retained for 30 days.
• Access Control & Server Management: Access to sensitive server components is strictly restricted via VPN and SSH access keys. Administrative control panel access is secured with strong authentication rules and mandatory Two-Factor Authentication (2FA).
• Transport Security (SSL/TLS): All connections to the website are secured using TLS certificates issued by Let's Encrypt (Internet Security Research Group - ISRG), configured to comply with the latest security standards. Certificates are automatically renewed every 2 months.
• Security Headers: We implement modern HTTP security headers to protect users against common web vulnerabilities. This includes HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks and cookie hijacking, and a Content Security Policy (CSP) that limits which scripts can run on the site.
• Password Protection: Passwords are never stored in readable form – they are hashed using Argon2id, a modern algorithm designed to resist cracking. Sensitive secrets, such as two-factor authentication keys, are encrypted in the database with AES-256-GCM.
• Account Protection: Every user can turn on two-step verification (authenticator app) or sign in with a passkey. Passkeys store only a public key on our side – fingerprints, face data and device PINs never leave your device. Repeated failed login attempts are limited automatically.

I actively monitor emerging security standards and best practices to ensure continuous protection.

Infrastructure & Service Locations

• Hosting & Server Infrastructure: The application and server are directly managed by the site administrator. The primary cloud server is hosted in Germany by Hetzner.
• CDN, DNS & DDoS Protection: We utilize Bunny.net for global CDN and DNS routing, improving global loading speeds while providing automated DDoS attack mitigation.
• Email: All email – system messages (account confirmation, password resets, security notices) and contact correspondence – is handled by STRATO servers located in Spain.
• Off-site Backup Storage: Automated backups of the server and application are stored in B2 Storage provided by Backblaze, located in data centers in the Netherlands.

Data Privacy & Compliance

All third-party services integrated into our infrastructure operate within the European Union (EU) or offer full EU-based storage options. All user and system data is stored strictly within the EU in full compliance with the GDPR (General Data Protection Regulation).