Trust & security

We build software for operations that cannot afford to fail. This page documents the controls, commitments, and disclosures for www.inger.sk and for the way Inger s.r.o. operates its own infrastructure. Every claim here is verifiable — either by headers on this site, by public endpoints listed below, or by independent audit.

1. Site controls (verifiable right now)

All responses from this site carry a consistent security posture:

• HTTPS enforced — HSTS max-age=31536000; includeSubDomains; preload
• Content-Security-Policy — strict default-src 'self' with explicit allow-lists for fonts
• Clickjack protection — X-Frame-Options: SAMEORIGIN + CSP frame-ancestors 'self'
• MIME-sniff prevention — X-Content-Type-Options: nosniff
• Referrer-Policy — strict-origin-when-cross-origin
• Permissions-Policy — geolocation, microphone, camera, payment, USB, and FLoC disabled
• Cross-Origin isolation — COOP same-origin, CORP same-origin
• Server fingerprint minimised — X-Powered-By unset, server signature off
• Dotfile and sensitive-path lockdown — .git, .env, .htaccess, composer.*, package*.json blocked

Run curl -I https://www.inger.sk/ — every control above should be visible in the response headers. If any claim here ever fails to match the actual response, email us and we will fix it.

2. Contact form — anti-abuse

The form at /#contact submits to a PHP endpoint protected by multiple layers:

• Rotating honeypot — field name changes per session, token-bound
• Timing token — expiry-bound nonce generated per page load
• Behavioural signals — focus, mouse, touch events; submissions that never interacted with the form are rejected
• Disposable-email filter
• Rate limiting — per-IP cap over rolling windows

We do not use reCAPTCHA or third-party anti-abuse SDKs; the approach is server-side and leaks no data off-premises.

3. Data handling (GDPR)

• Data controller: Inger s.r.o., Banská Bystrica, Slovakia
• We process only: name, email, message submitted via the contact form, plus standard server access logs
• No analytics cookies, no tracking pixels, no advertising SDKs, no session replay
• The only localStorage key we set is theme (light/dark preference)
• Retention: up to 12 months for inquiries that do not lead to an engagement; statutory 10 years for accounting records of active engagements
• Full policy: Privacy Policy

You have the right of access, rectification, erasure, restriction, objection, and portability under Articles 15–22 GDPR. Supervisory authority: Office for Personal Data Protection (ÚOOÚ). To exercise any right, email info@inger.sk.

4. Responsible disclosure

If you believe you have found a security issue affecting www.inger.sk or any Inger-operated service, please report it directly — do not post publicly, and do not test against production systems beyond a good-faith proof of concept.

• Security contact: security@inger.sk
• Backup contact: info@inger.sk
• Machine-readable: /.well-known/security.txt
• Preferred languages: Slovak, English
• Acknowledgement: within 2 business days. Initial triage within 5 business days. Fix target depends on severity (see below).

We do not currently run a paid bug-bounty programme. We will credit researchers publicly (unless you prefer anonymity) and will not pursue legal action against good-faith research that follows this policy.

5. Incident response commitment

For any security incident affecting a service under our contract, we commit to the following timing — aligned with the NIS2 Directive (EU 2022/2555) baselines that apply to our enterprise clients:

• Early warning to the affected client within 24 hours of confirmed detection
• Incident notification with initial assessment within 72 hours
• Final report (root cause, remediation, preventive measures) within 30 days
• Severity classification: S1 service-down, S2 degraded, S3 contained, S4 informational — with escalation paths documented per engagement

Contract-specific SLAs may tighten these windows; they do not relax them.

6. Regulatory posture

GDPR (EU 2016/679)

Inger s.r.o. processes personal data as a controller for marketing inquiries submitted via this site. In client engagements, we typically act as a processor under the client's data-processing agreement. We have not appointed a Data Protection Officer — as a small engineering studio we do not meet the mandatory-DPO thresholds of Art. 37.

NIS2 (EU 2022/2555)

Inger s.r.o. is not directly in NIS2 scope as an entity (we do not meet the size and sector thresholds). However, several of our clients are essential or important entities, which extends NIS2 supply-chain obligations to us contractually. We run the following controls as a consequence:

• Named security contact and public disclosure policy (this page)
• 24 h / 72 h / 30 d incident timing alignment (see section 5)
• Documented change-management and release process (internal)
• Minimised third-party footprint (see section 8)
• Access control, credential rotation, and endpoint hardening on operator devices
• Annual self-review using our own scanning tooling (see section 9)

DORA (EU 2022/2554)

Inger s.r.o. is not a financial entity and therefore is not in DORA direct scope. For client engagements where the client is DORA-regulated, we accept Article 28/30 obligations contractually — including registration as an ICT third-party service provider, audit rights, exit provisions, and incident classification. A technical & organisational measures (TOM) summary is available on request to prospective DORA-scope clients.

7. Accessibility commitment

This site targets WCAG 2.2 level AA. Current implementation:

• Semantic HTML5 landmarks (<main>, <nav>, <footer>)
• Skip link to main content
• :focus-visible indicators on all interactive elements
• Heading hierarchy without level skips
• Alt text on all informative images; decorative SVG icons marked aria-hidden
• Form labels bound to inputs; live-region status for form submit
• FAQ disclosure buttons expose aria-expanded / aria-controls
• prefers-reduced-motion respected

If you encounter an accessibility barrier, email info@inger.sk — we treat a11y issues as bugs and will respond within 5 business days.

8. Subprocessors and third parties

For this site specifically (www.inger.sk):

• o2switch (France, EU) — web hosting and email; ISO 27001 certified
• Fonts — Inter and JetBrains Mono are served directly from our own server. No third-party font CDN is called.
• GitHub (Microsoft Corp., US) — source control and CI for site deploy. Standard contractual clauses apply.

For client engagements, the subprocessor list is engagement-specific and documented in the corresponding data-processing agreement.

9. Own-tooling proof

We build two tools in this space and we run them on ourselves:

• ZulienScore — an open web audit tool covering performance, security, privacy, accessibility, SEO, AI-readiness, and vulnerability exposure across 90+ checkpoints. We scan inger.sk on every release and investigate regressions before they ship to production on client sites.
• Axe-core + viewport regression — WCAG 2.2 AA automated scan and 3-viewport layout check run on every deploy via GitHub Actions. Workflow source is public (.github/workflows/a11y.yml). Current status: 0 violations, 0 overflow elements.
• NISMap — a NIS2 entity-scoping and compliance platform (private, available to auditor and MSP operators). Our own NIS2 posture, summarised above, was produced by running the NISMap scoping engine on Inger s.r.o.

If we recommend a check to our clients, the same check is running on our own site first.

10. Vendor due diligence (enterprise procurement)

A pre-filled vendor due-diligence response — legal entity, data handling, security controls, operational resilience, compliance mapping, subprocessors, and legal posture — is published as a separate page and as machine-readable JSON:

• Vendor DD (human-readable)
• /vendor-dd.json (machine-readable, safe to ingest)
• ISMS — public summary (control-by-control mapping to ISO 27001:2022 Annex A)

Bespoke artifacts (signed DPA, TOM, SIG Lite / CAIQ completions, insurance certificates) are available under NDA — write to info@inger.sk with subject "Vendor DD — [company]".

11. Changes to this page

We revise this page whenever controls change, whenever regulatory scope changes, or at least once per year. Material changes are dated at the top. Historical versions are available on request.