Privacy Policy

As of: September 27, 2026 · Responsible: Bocert GmbH (Legal Notice)

This statement describes which personal data we process when you visit itsecurity.today and when you use our scanning service, and what rights you have. Principle: We collect as little as possible. For a scan, we need a domain and an e-mail address. Nothing more.

1. Data Controller and Contact

Bocert GmbH, Stresemannstr. 23, 10963 Berlin, E-mail info@itsecurity.today. Managing Director: Jens Winter, HRB 180200 B, Berlin-Charlottenburg District Court.

2. This Website Itself: No Cookies, No Tracking

The landing page of itsecurity.today sets no cookies and loads no external scripts, fonts, pixels or analytics tools (no Google Analytics, no Matomo, no Meta Pixel, no advertising or chat tools). As a result, no personal data is transmitted to third parties during a mere visit.

To protect against automated abuse attempts, the form contains a hidden honeypot field and a rate limiter per source. In doing so, only a non-reversible hash is generated from your IP address for this rate limiter; the IP address itself is neither stored nor evaluated.

When the pages are accessed, the web server necessarily processes access data for technical reasons (server log files: IP address, date/time, requested file, browser type). The legal basis is Art. 6 Abs. 1 lit. f DSGVO (our interest in secure and uninterrupted operation). These logs are deleted shortly thereafter and are not merged with other data.

3. Scan Request via the Form

When you submit a scan request, we process the information you enter:

• Domain of the website to be examined - for conducting the scan
• Email address - so that we can send you the verification code and the result

The legal basis is Art. 6 Abs. 1 lit. b DSGVO (pre-contractual measures or performance of the service you requested). We delete this information as soon as the purpose ceases to apply, at the latest upon expiry of statutory retention periods.

3.1 Record of Your Consents

Additionally, we store a log of whether and when you set the two optional consents (email advertising and reference listing), including the text version used, timestamp, IP hash, and browser identifier. The legal basis is Art. 6 Abs. 1 lit. c DSGVO in conjunction with § 26 Abs. 3 TDDDG: we must be able to demonstrate that consent has been given. These consents are voluntary; the scan takes place regardless of them.

You may revoke the consents at any time with effect for the future, informally by email to info@itsecurity.today or via the unsubscribe link in each email. We will then remove advertising or reference listing within 7 business days; the proof-of-consent log is retained for the duration of the retention obligation.

4. Operator Confirmation and Its Proof

In the form, you confirm by ticking a checkbox that you are the operator of the website or are authorized by the operator, and you additionally confirm the scan order via the personal link in our confirmation email. We store these confirmations (domain, time, text version of the form, IP hash, browser identifier) in order to be able to demonstrate that we have not performed unauthorized scans on third-party systems (legal basis Art. 6 Abs. 1 lit. f DSGVO, our interest in legal certainty and the protection of third parties from misuse of our service).

5. What Data the Scan Itself Collects

The scan contacts your website exclusively from the outside, with a maximum of one request per second, without login tests, without guessing access points or directories, and without exploiting vulnerabilities. Only publicly answered technical information is collected:

• TLS/certificate information and response headers of your website
• Publicly accessible files and version information (e.g. logs, readme files, generator tags)
• Publicly accessible API responses (e.g. user enumeration), cookie properties, third-party integrations
• SPF, DKIM and DMARC records of your domain as well as publicly accessible subdomains

These details concern your web presence as corporate infrastructure. To the extent that it nevertheless contains personal data (e.g., names of publicly listed editors or IP addresses contained in log files), we process them exclusively for the purpose of creating the report and make them accessible in reports only as findings including supporting evidence, not for our own purposes.

We store scan results and reports for as long as you have an interest as a customer (in particular for the free retest within 30 days) and beyond that to the extent that commercial or tax law retention periods require. You may request deletion at any time (Section 8).

6. Paid Reports and Payment

If you opt for a paid report, we additionally process the data required for invoicing and payment (billing address/company name, e-mail, ordered service, payment status, invoice data). Payment processing: Stripe Payments Europe Ltd., Dublin (processor on the basis of a DPA; EU Standard Contractual Clauses or Data Privacy Framework). Legal basis: Art. 6(1)(b) and (c) DSGVO (contract and tax retention).

7. Hosting and Data Processing on Behalf of Others

The website and scan platform are hosted on servers in Germany (1&1 Mail & Media GmbH / Hetzner Cloud GmbH, depending on the component), each on the basis of a contract pursuant to Art. 28 DSGVO. Transfer to third countries takes place only within the scope of the payment processing mentioned in Section 6; in doing so, adequacy decisions or Standard Contractual Clauses ensure an adequate level of protection. Your data are not passed on to any other third parties, in particular no sales or enrichment with external data sets.

8. Your Rights

• Right to information about the data stored about you (Art. 15 DSGVO)
• Rectification of inaccurate data (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO) and restriction of processing (Art. 18 DSGVO)
• Data portability in machine-readable form (Art. 20 DSGVO)
• Objection to processing based on legitimate interests (Art. 21 DSGVO)
• Revocation of Granted Consents with Effect for the Future (Art. 7 Abs. 3 DSGVO)

For the exercise of rights, an e-mail to info@itsecurity.today is sufficient. We will respond to your request within one month.

9. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, e.g., with the Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de, or with the authority responsible for your place of residence.

10. Automated Decision-Making

No automated decision-making within the meaning of Art. 22 DSGVO takes place. The scan evaluates technical findings on a rule-based basis; you decide for yourself whether to purchase a report.