# Security

What we do on this website to keep your data safe. Only things that are actually in place.

## Connection

-   The website only runs over HTTPS. Browsers remember this via HSTS and never connect unencrypted.
-   Strict security headers on every page: Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy.
-   Our own scripts only load from our domain. Statistics and advertising tools only load after you agree in the cookie banner, and only from addresses we have individually allowed in the Content Security Policy. No social media plug-ins.

## Your privacy

-   Cookies are only set by statistics and advertising tools, and only with your consent. "Accept all" and "Only necessary" are equal choices. You can change your choice at any time via "Cookie settings" at the bottom of every page.
-   For basic statistics we use Vercel Web Analytics. It works without cookies and without personal profiles.
-   Fonts and images are served from our own server. No data goes to Google Fonts or similar services when you visit.
-   The jobs page loads open positions directly from the chainstaff platform. Only this page is allowed to make that connection.

## Forms

-   The contact form is processed by a function in Frankfurt (EU) and sent to us as an email. Nothing is stored on the website itself.
-   Input is shortened and cleaned before it is passed on. An invisible field keeps spam bots out.
-   Newsletter sign-ups go directly to our list at Brevo. You can unsubscribe at any time with the link in every email.

## Found a security issue?

Thanks for looking. Email us at [hello@chainstaff.info](mailto:hello@chainstaff.info) with a short description and, if possible, the steps to reproduce it. Please do not exploit the issue and give us time to fix it before you make it public.

Our contact details for security reports are also available in machine-readable form at [/.well-known/security.txt](/.well-known/security.txt).

Applies to the website chainstaff.app. For the app and the company dashboard, see our [privacy policy](/en-gb/rechtliches#datenschutz).