Trust & security

We build software for operations that cannot afford to fail. This page documents the controls, commitments, and disclosures for www.inger.sk and for the way Inger s.r.o. operates its own infrastructure. Every claim here is verifiable — either by headers on this site, by public endpoints listed below, or by independent audit.

1. Site controls (verifiable right now)

Below is the security posture this site returns, transcribed from the response itself rather than from the configuration that asks for it. Those are not always the same thing, and it is the response that reaches the browser.

Reproduce the whole panel with one command: curl -sI https://www.inger.sk/. Nothing above is behind a login, and no header is listed here that the response does not carry.

Two caveats we would rather state than have you find. The response also carries a second, weaker strict-transport-security (max-age=31536000, without includeSubDomains or preload) and a second, identical x-frame-options, both appended by an nginx layer the hosting provider runs in front of our Apache. Per RFC 6797 a browser applies the first HSTS header it receives, which is ours, and the duplicate x-frame-options carries the same value — so neither weakens the result. That layer also rewrites cache-control on HTML to max-age=86400, overriding the max-age=0, must-revalidate we set; a returning visitor can therefore see an older copy of a page for up to a day. We do not control that layer, and we would rather say so than publish a list that quietly omits it.

Two controls on this site are visible by what they refuse rather than by a header. .git, .env, .htaccess, composer.* and package*.json all answer 403 — curl -o /dev/null -w '%{http_code}\n' https://www.inger.sk/.env shows it. And there is no analytics or tag-manager request to block, because the connect-src 'self' above means the page has nowhere off-origin to talk to.

If any claim on this page ever stops matching the actual response, email us and we will fix it.

2. Contact form — anti-abuse

The form at /#contact submits to a PHP endpoint protected by multiple layers:

• Rotating honeypot — the field name is derived from the current date and a server-side secret, so it changes once a day and cannot be guessed without the secret
• Timing token — an HMAC-signed timestamp issued when the page loads, accepted only between 3 seconds and 1 hour after issue. It is not single-use, so it is a delay gate rather than a nonce
• Behavioural signals — focus, mouse, touch events; submissions that never interacted with the form are rejected
• Disposable-email filter
• Rate limiting — one accepted message per IP per 60 seconds

We do not use reCAPTCHA or third-party anti-abuse SDKs; the approach is server-side and leaks no data off-premises.

3. Data handling (GDPR)

• Data controller: Inger s.r.o., Banská Bystrica, Slovakia
• We process only: name, email, message submitted via the contact form, plus standard server access logs
• No analytics cookies, no tracking pixels, no advertising SDKs, no session replay
• The only localStorage key we set is theme (light/dark preference)
• Retention: up to 12 months for inquiries that do not lead to an engagement; statutory 10 years for accounting records of active engagements
• Full policy: Privacy Policy

You have the right of access, rectification, erasure, restriction, objection, and portability under Articles 15–22 GDPR. Supervisory authority: Office for Personal Data Protection (ÚOOÚ). To exercise any right, email info@inger.sk.

4. Responsible disclosure

If you believe you have found a security issue affecting www.inger.sk or any Inger-operated service, please report it directly — do not post publicly, and do not test against production systems beyond a good-faith proof of concept.

• Security contact: security@inger.sk
• Backup contact: info@inger.sk
• Machine-readable: /.well-known/security.txt
• Preferred languages: Slovak, English
• Acknowledgement: within 2 business days. Initial triage within 5 business days. Fix target depends on severity (see below).

We do not currently run a paid bug-bounty programme. We will credit researchers publicly (unless you prefer anonymity) and will not pursue legal action against good-faith research that follows this policy.

5. Incident response commitment

For any security incident affecting a service under our contract, we commit to the following timing — aligned with the NIS2 Directive (EU 2022/2555) baselines that apply to our enterprise clients:

• Early warning to the affected client within 24 hours of confirmed detection
• Incident notification with initial assessment within 72 hours
• Final report (root cause, remediation, preventive measures) within 30 days
• Severity classification: S1 service-down, S2 degraded, S3 contained, S4 informational — with escalation paths documented per engagement

Contract-specific SLAs may tighten these windows; they do not relax them.

6. Regulatory posture

GDPR (EU 2016/679)

Inger s.r.o. processes personal data as a controller for marketing inquiries submitted via this site. In client engagements, we typically act as a processor under the client's data-processing agreement. We have not appointed a Data Protection Officer — as a small engineering studio we do not meet the mandatory-DPO thresholds of Art. 37.

NIS2 (EU 2022/2555)

Inger s.r.o. is not directly in NIS2 scope as an entity (we do not meet the size and sector thresholds). However, several of our clients are essential or important entities, which extends NIS2 supply-chain obligations to us contractually. We run the following controls as a consequence:

• Named security contact and public disclosure policy (this page)
• 24 h / 72 h / 30 d incident timing alignment (see section 5)
• Documented change-management and release process (internal)
• Minimised third-party footprint (see section 8)
• Access control, credential rotation, and endpoint hardening on operator devices
• Annual self-review using our own scanning tooling (see section 9)

DORA (EU 2022/2554)

Inger s.r.o. is not a financial entity and therefore is not in DORA direct scope. For client engagements where the client is DORA-regulated, we accept Article 28/30 obligations contractually — including registration as an ICT third-party service provider, audit rights, exit provisions, and incident classification. A technical & organisational measures (TOM) summary is available on request to prospective DORA-scope clients.

7. Accessibility commitment

This site targets WCAG 2.2 level AA. Current implementation:

• Semantic HTML5 landmarks (<main>, <nav>, <footer>)
• Skip link to main content
• :focus-visible indicators on all interactive elements
• Heading hierarchy without level skips
• Alt text on all informative images; decorative SVG icons marked aria-hidden
• Form labels bound to inputs; live-region status for form submit
• FAQ disclosure buttons expose aria-expanded / aria-controls
• prefers-reduced-motion respected

If you encounter an accessibility barrier, email info@inger.sk — we treat a11y issues as bugs and will respond within 5 business days.

8. Subprocessors and third parties

For this site specifically (www.inger.sk):

• o2switch (France, EU) — web hosting and email; ISO 27001 certified
• Fonts — Inter and JetBrains Mono are served directly from our own server. No third-party font CDN is called.
• GitHub (Microsoft Corp., US) — source control and CI for site deploy. Standard contractual clauses apply.

For client engagements, the subprocessor list is engagement-specific and documented in the corresponding data-processing agreement.

9. Own-tooling proof

We build two tools in this space and we run them on ourselves:

• ZulienScore — an open web audit tool covering performance, security, privacy, accessibility, SEO, AI-readiness, and vulnerability exposure across 90+ checkpoints. We re-scan inger.sk periodically, not on every release — the scorecard below carries the date of the last scan so you can judge how fresh it is rather than take our word for the cadence.
• Axe-core + viewport regression — WCAG 2.2 AA automated scan and 3-viewport layout check run on every successful deploy, via a GitHub Actions workflow triggered by the deploy itself. The repository is private, so you cannot read that workflow — but you do not have to take the result on trust either: npx @axe-core/cli https://www.inger.sk/ reproduces it against the live page. Current status: 0 violations, 0 overflow elements.
• NISMap — a NIS2 entity-scoping and compliance platform (private, available to auditor and MSP operators). Our own NIS2 posture, summarised above, was produced by running the NISMap scoping engine on Inger s.r.o.

If we recommend a check to our clients, the same check is running on our own site first.

10. Vendor due diligence (enterprise procurement)

A pre-filled vendor due-diligence response — legal entity, data handling, security controls, operational resilience, compliance mapping, subprocessors, and legal posture — is published as a separate page and as machine-readable JSON:

• Vendor DD (human-readable)
• /vendor-dd.json (machine-readable, safe to ingest)
• ISMS — public summary (control-by-control mapping to ISO 27001:2022 Annex A)

Bespoke artifacts (signed DPA, TOM, SIG Lite / CAIQ completions, insurance certificates) are available under NDA — write to info@inger.sk with subject "Vendor DD — [company]".

11. Changes to this page

We revise this page whenever controls change, whenever regulatory scope changes, or at least once per year. Material changes are dated at the top. Historical versions are available on request.