Security & Privacy
Last updated: 28 September 2026
We hold our own platform to the standards we build for our clients. Here is how this site is secured and how we handle data — every claim below is verifiable in your browser's developer tools.
Privacy by design
This site uses no cookies and no third-party trackers. Analytics are cookieless and self-hosted on our own Swiss infrastructure, so no personal data leaves our control and no consent banner is required. Our practices align with the Swiss FADP and the EU GDPR.
Swiss data residency
The website and its analytics run entirely on Infomaniak Public Cloud servers in Switzerland, operated by a Swiss company. Visitor data stays within Swiss jurisdiction — it is never processed on US or other non-Swiss infrastructure.
Encryption in transit
All traffic is served exclusively over HTTPS with a valid TLS certificate; plain HTTP requests are permanently redirected. HTTP Strict Transport Security (HSTS) with preload instructs browsers to only ever connect over encrypted channels.
Hardened by default
The site ships a strict Content-Security-Policy and a complete set of modern security headers (Permissions-Policy, cross-origin isolation, clickjacking protection). The web server runs as a non-root user, with all capabilities dropped and a read-only root filesystem.
A strict, verifiable Content-Security-Policy
This site's Content-Security-Policy contains no 'unsafe-inline': every inline script and style is individually authorized by a SHA-256 hash, and the allowlist is regenerated from the built site on every deployment. You can verify this directly in the response headers of this very page.
Data minimization
This website has no forms and no user accounts. It sets no cookies, and its analytics count visits without identifying you. The only personal data we receive is what you choose to send us by email. We do not sell data.
Responsible disclosure
If you discover a security issue, we want to hear from you. Report it to info@heldevia.ch — see our machine-readable policy at /.well-known/security.txt. We acknowledge reports and work to resolve valid issues promptly.