Legal
Security
The security measures currently implemented on the Insider Magazin website and workspace, what is not yet in place, and how to report a vulnerability.
Last reviewed: pending legal review
01Our approach
This page lists only measures that are implemented today and can be verified, for example by inspecting the website's response headers. Items that depend on decisions not yet made are marked as pending.
Certifications and audits
Insider Magazin does not currently hold any third-party security certification (such as ISO/IEC 27001 or SOC 2) and has not undergone an independent security audit or penetration test. We will update this page if that changes.
Last updated: [Pending: Date of last legal review].
02Transport and HTTP security headers
The website is designed to be served over HTTPS in production; encryption in transit depends on the hosting configuration. [Pending: Hosting provider and TLS configuration]
Every response from the website includes the following headers:
| Header | Value | Effect |
|---|---|---|
X-Content-Type-Options | nosniff | Stops browsers from guessing content types, which reduces some script-injection risks |
Referrer-Policy | strict-origin-when-cross-origin | Sends only the site origin, not full page addresses, to other sites, and nothing over insecure connections |
X-Frame-Options | SAMEORIGIN | Prevents other sites from embedding our pages in frames (clickjacking protection) |
Permissions-Policy | camera=(), microphone=(), geolocation=() | Disables access to the camera, microphone and location for the site |
The website also does not send the X-Powered-By header that identifies the underlying framework.
03Secrets and integrations
- API keys and other secrets, such as those for email delivery or a webhook, are stored only in server-side environment variables and are never sent to the browser.
- When a customer's own HTTPS API is connected, the data adapter runs on the server; the credentials used to call that API stay on the server.
- Data returned by a connected API is validated against the documented dataset format before it is used.
04Website forms
- Demo request and contact form input is validated both in the browser and on the server.
- A hidden honeypot field and basic rate limiting help to block automated and abusive submissions.
- Submissions are delivered by email or to a configured webhook. The website does not store them in its own database.
05Data minimisation
- The website sets no analytics, advertising or tracking cookies. The only cookie it sets is a functional language preference; see the Cookie Policy.
- Dataset statistics are computed in the visitor's browser from the loaded data.
- The illustrative datasets shown on the website are synthetic and contain no personal data.
06Not yet defined
The following items will be documented once the corresponding decisions have been made:
- Hosting provider and region
- [Pending: Hosting provider and data region]
- Backups
- [Pending: Backup policy and frequency]
- Encryption at rest
- [Pending: Encryption at rest provided by the hosting provider]
- Access control for our team
- [Pending: Internal access control and multi-factor authentication policy]
- Incident response
- [Pending: Incident response process and customer notification timeline]
07Reporting a vulnerability
If you believe you have found a security vulnerability in this website or the Service, please email support@insidermagazin.com with the subject line "Security report". Include a description of the issue, the steps to reproduce it, the affected URL or component, and any proof of concept.
- Please give us a reasonable opportunity to fix the issue before disclosing it publicly.
- Do not access, modify or delete data that does not belong to you, and do not degrade the service for others. Stop testing and report as soon as you have confirmed an issue.
- Automated scanning and load testing are not permitted without our prior written permission; see the Acceptable Use Policy.
We do not currently run a bug bounty programme. We will acknowledge reports and keep you informed of our progress. [Pending: Target acknowledgement time for security reports]