Legal
Security
The security measures currently implemented on the Insider Magazin website and workspace, what is not yet in place, and how to report a vulnerability.
Last updated: 5 Nov 2026
01Our approach
This page lists only measures that are implemented today and can be verified, for example by inspecting the website's response headers.
Certifications and audits
Insider Magazin does not currently hold any third-party security certification (such as ISO/IEC 27001 or SOC 2) and has not undergone an independent security audit or penetration test. We will update this page if that changes.
Last updated: 5 November 2026.
02Transport and HTTP security headers
The website is designed to be served over HTTPS in production; encryption in transit depends on the hosting configuration. The website is hosted on Vercel; every request is served over HTTPS (TLS) with automatically managed certificates, HTTP requests are redirected to HTTPS, and HTTP Strict Transport Security (HSTS) is enabled.
Every response from the website includes the following headers:
| Header | Value | Effect |
|---|---|---|
X-Content-Type-Options | nosniff | Stops browsers from guessing content types, which reduces some script-injection risks |
Referrer-Policy | strict-origin-when-cross-origin | Sends only the site origin, not full page addresses, to other sites, and nothing over insecure connections |
X-Frame-Options | SAMEORIGIN | Prevents other sites from embedding our pages in frames (clickjacking protection) |
Permissions-Policy | camera=(), microphone=(), geolocation=() | Disables access to the camera, microphone and location for the site |
The website also does not send the X-Powered-By header that identifies the underlying framework.
03Secrets and integrations
- API keys and other secrets, such as those for email delivery or a webhook, are stored only in server-side environment variables and are never sent to the browser.
- When a customer's own HTTPS API is connected, the data adapter runs on the server; the credentials used to call that API stay on the server.
- Data returned by a connected API is validated against the documented dataset format before it is used.
04Website forms
- Demo request and contact form input is validated both in the browser and on the server.
- A hidden honeypot field and basic rate limiting help to block automated and abusive submissions.
- Submissions are delivered by email or to a configured webhook. The website does not store them in its own database.
05Data minimisation
- The website sets no analytics, advertising or tracking cookies. The only cookie it sets is a functional language preference; see the Cookie Policy.
- Dataset statistics are computed in the visitor's browser from the loaded data.
- The illustrative datasets shown on the website are synthetic and contain no personal data.
06Not yet defined
The following items will be documented once the corresponding decisions have been made:
- Hosting provider and region
- Vercel Inc. Pages are delivered through Vercel's global network; server functions run in the United States (Washington, D.C. region).
- Backups
- We do not store customer data on our servers (EuroInsider files are processed in your browser), so no customer data backups exist. The website itself can be redeployed from its source code at any time.
- Encryption at rest
- We do not store customer data at rest. Data stored by our providers (hosting, email) is encrypted at rest under their own security programmes.
- Access control for our team
- Access to the hosting, email and Digistore24 accounts is limited to the people who operate the service, and multi-factor authentication is used where the provider offers it.
- Incident response
- We investigate reported incidents promptly and notify affected customers without undue delay, and within 72 hours where the law requires it.
07Reporting a vulnerability
If you believe you have found a security vulnerability in this website or the Service, please email support@insidermagazin.com with the subject line "Security report". Include a description of the issue, the steps to reproduce it, the affected URL or component, and any proof of concept.
- Please give us a reasonable opportunity to fix the issue before disclosing it publicly.
- Do not access, modify or delete data that does not belong to you, and do not degrade the service for others. Stop testing and report as soon as you have confirmed an issue.
- Automated scanning and load testing are not permitted without our prior written permission; see the Acceptable Use Policy.
We do not currently run a bug bounty programme. We will acknowledge reports and keep you informed of our progress. We acknowledge security reports within 3 business days.