From technical risk to a verified solution.

We map the entire website, its functions and safe test conditions before the investigation begins.

• The exact domain, all associated subdomains and all website environments have been inventoried.
• The owner or an authorized client has permitted the investigation in writing.
• Public pages, administration functions, accounts, forms, APIs and connected services are documented.
• User roles, important actions and business-critical visitor journeys have been mapped.
• The website's personal data, data flows and external recipients have been inventoried.
• Required test accounts and temporary access are provided securely, individually and traceably.
• Safe test windows, emergency contacts and agreements to protect business operations have been confirmed.
• Available backups, recovery options and a rollback path have been checked before changes.

We check what is publicly accessible and how the domain, hosting, server, cloud and browser security are configured.

• DNS, HTTPS, TLS certificates and redirects safely direct visitors to the intended domain.
• Publicly accessible subdomains, services, ports and administration routes are known and necessary.
• Hosting, cloud and server settings restrict access according to the principle of least privilege.
• Browser headers protect against unwanted loading, embedding, interpretation and transmission of information.
• Permitted origins for browser and API traffic are explicitly configured and restricted as much as possible.
• Error messages, debugging functions and status pages do not disclose sensitive technical information.
• Temporary files, backups, source maps, configuration files and development tools are not publicly accessible.
• Caching and intermediary layers prevent personal or confidential content from reaching the wrong visitor.

We assess how users and administrators sign in, recover their accounts and stay signed in. We verify that each user can access only permitted data and actions.

• Sign-in and registration verify identity without unnecessarily disclosing account information.
• Password rules, storage and change processes support strong and unique passwords.
• Administrator accounts and other sensitive roles use appropriate multifactor authentication.
• Email verification and account recovery use temporary, single-use and securely delivered links or codes.
• Session cookies are protected, restricted to the correct environment and inaccessible to unwanted scripts.
• Sessions are renewed after sign-in and sensitive changes and cannot be taken over through a previously known session.
• Sign-out, automatic expiry, password changes and account blocking correctly end existing access.
• Repeated sign-in attempts and automated account abuse are limited, logged and appropriately followed up.
• Every protected page, API and action checks permissions on the server, not only in the interface.
• Users can view or change only their own data, documents, orders and other objects.
• Roles and permissions follow least privilege and are applied consistently throughout the website.
• Administration functions and sensitive actions are accessible only to explicitly authorized accounts.
• Data from different organizations, customers or workspaces remains technically separated.
• File links, exports and downloads perform the same access checks as the corresponding web page.
• Deactivated accounts and revoked roles immediately lose their previous access.
• Background tasks, integrations and system accounts receive only the permissions their specific function requires.

We check how the website receives, processes, displays, forwards and handles data as files.

• All input is checked on the server for permitted format, length, type and meaning.
• Database queries, commands and templates process input without executing data as instructions.
• Displayed content is appropriately encoded so entered text does not become unwanted browser code.
• Actions that change data or settings are protected against requests from unwanted websites.
• File uploads restrict type, size, name and storage location and are processed securely or isolated.
• Downloads and file paths can access only permitted files within the intended storage.
• APIs consistently validate methods, data structures, content types, errors, access permissions and request rates.
• Webhooks, redirects and outbound server connections accept only trusted destinations and valid messages.

We compare the website's actual data processing with its privacy information and applicable GDPR obligations.

• Personal data, categories of data subjects, sources, purposes, recipients and storage locations are fully inventoried.
• The necessity, legal basis and any conditions for sensitive data are substantiated for every website-related processing activity.
• The privacy notice clearly and accurately describes what the website actually does with personal data.
• Forms, accounts and default settings request and display only the personal data needed for the purpose.
• Cookies, pixels and other trackers are correctly categorized and required consent is requested beforehand, freely and demonstrably.
• Consent can be withdrawn as easily as it was given and the website respects the changed choice.
• Retention periods and deletion processes demonstrably work for application data, uploads, logs and relevant backups.
• Website processes support requests for access, correction, deletion, restriction, portability and objection where applicable.
• Website-related processors, external services and international transfers are known and covered by appropriate agreements or safeguards.
• Privacy by design, accountability evidence, any need for a DPIA and preparation for a website-related data breach have been assessed.

We assess how passwords, keys, tokens and sensitive data are protected throughout their lifecycle.

• Keys, tokens and passwords do not appear in browser code, public files, source code history or logs.
• Secrets are centrally managed, kept accessible only to a limited extent and securely replaced when needed.
• Passwords are stored with a suitable, slow and current password hashing function.
• Sensitive data is protected in transit with current encryption and correct certificate validation.
• Sensitive stored data is encrypted when risk and use require it.
• Cryptographic algorithms, key sizes and settings are current and used for their intended purpose.
• Security tokens and recovery codes are unpredictable, have limited validity, are single-use where needed and can be securely revoked.
• Confidential values do not appear in web addresses, unsecured browser storage, analytics data or shared caches.

We check the origin, currency and security of packages, external scripts and the build and publication process.

• Application packages, runtimes, external scripts and other dependencies are fully and reproducibly inventoried.
• Known vulnerabilities and unsupported versions have been identified and addressed according to risk.
• Versions and lockfiles prevent unexpected changes during installation and build.
• Dependencies come from trusted sources and unnecessary packages or scripts have been removed.
• External browser scripts are limited, reviewed and governed by appropriate browser rules.
• The build and publication process protects source code, artifacts, approvals and production data from unwanted changes.
• Automation accounts and CI/CD secrets have minimal permissions and are not unnecessarily shared with external code.
• Development, testing and diagnostic tools are separated from production and cannot be activated publicly.

We test whether important website processes remain secure during unexpected, automated or improper use.

• Important user journeys enforce the intended order, conditions and permitted state transitions.
• Prices, discounts, quantities, permissions and other business values are validated by the server.
• Payments, orders, reservations and similar actions are not unintentionally processed twice or out of sequence.
• Limits on requests, accounts, stock, usage or benefits cannot easily be bypassed.
• Invitations, approvals, cancellations and account changes check the current authorization and status every time.
• Forms and public functions are appropriately protected against spam, large-scale abuse and automated fraud.
• Concurrent requests and repeated messages do not cause duplicate benefits or inconsistent data.
• Results from payment providers, identity services and other external parties are independently confirmed on the server.

We assess useful logs, incident handling, backups and demonstrable recovery.

• Sign-ins, administration actions, permission changes, sensitive data actions and security events are logged in a useful way.
• Logs contain no passwords, tokens or more personal data than needed for security and follow-up.
• Log access, integrity, retention periods and timestamps support reliable investigation.
• Backups are created automatically, encrypted, sufficiently separated and according to a defined retention schedule.
• Recovery from backup has been tested recently and meets the agreed recovery objectives for the website and data.
• An incident plan defines reporting routes, responsibilities, evidence preservation and safe emergency measures.
• The data breach process supports timely assessment, documentation and required notification or communication under the GDPR.
• New versions can be published in a controlled manner, monitored and safely rolled back if needed.
• After an incident or significant change, causes, corrections and retests are demonstrably followed up.