Security
How this site is secured
We advise clients on their security, so it is fair to ask what we do for our own website. This page says so in terms you can check yourself, against the live site.
What this site is
Files, not an application
Every page on thinksmart.eu is an HTML file, written out in advance by a build step and served as it is. There is no content management system on the public side, no database and no server-side rendering. What you read is what was built.
JavaScript is optional. Every page reads, navigates and switches language without it; the script only adds behaviour to something that already works.
The API has two endpoints a visitor's browser talks to: the contact form (/api/contact) and the short-lived challenge it uses (/api/challenge). Both are described below. Everything else a visitor reaches is a file.
Response headers
What every response carries
Sent with every page and every file. Open the network panel of your browser, or run curl -I https://thinksmart.eu/, and compare.
| Header | Value |
|---|---|
Content-Security-Policy | The whole policy, directive by directive, is in the next table. |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), xr-spatial-tracking=(), interest-cohort=() |
Cross-Origin-Opener-Policy | same-origin |
Cross-Origin-Resource-Policy | same-origin |
X-Powered-By | Removed. The platform adds it by default, and it names the software stack to anyone who asks. |
Content Security Policy
What a page may load, directive by directive
The policy is generated from the pages that were built. The hash permits the single inline script every page carries. Resources are served from this origin, with the listed analytics domains allowed after consent.
| Directive | Value |
|---|---|
default-src | 'self' |
base-uri | 'self' |
object-src | 'none' |
frame-ancestors | 'none' |
frame-src | 'none' |
script-src | 'self' 'sha256-VNIA72ttmp3r9LQua08rreePojz9lQk1zVXM5Y0bTT8=' https://www.clarity.ms https://scripts.clarity.ms |
style-src | 'self' 'unsafe-inline' |
font-src | 'self' |
img-src | 'self' data: https://*.clarity.ms https://c.bing.com |
connect-src | 'self' https://*.clarity.ms https://c.bing.com |
form-action | 'self' |
manifest-src | 'self' |
worker-src | 'self' |
upgrade-insecure-requests | No value: the directive is the instruction. |
The one concession is 'unsafe-inline' for styles: a few layout values are set with a style attribute, and CSP has no hash for attributes. Inline script is not allowed anywhere.
Transport
Encrypted, and only encrypted
HTTPS only. Plain HTTP is answered with a redirect and never with content.
HSTS for two years, subdomains included: a browser that has seen this site once will not try HTTP again.
TLS 1.2 is the minimum. Older versions are refused at the platform edge.
Issued by DigiCert, managed and renewed by the platform. One certificate per hostname, thinksmart.eu and www.thinksmart.eu.
The DNS zone is signed with DNSSEC, so the answer to "where is thinksmart.eu" cannot be forged on the way to you. Check with dig +short thinksmart.eu DS.
Mail from thinksmart.eu is covered by SPF and by DMARC with a reject policy: dig +short TXT _dmarc.thinksmart.eu.
Third parties
What we do not load
Before you accept statistics, all resources load from this domain. Microsoft Clarity loads after consent. Fonts and images are hosted here; there are no embedded videos or chat widgets.
Microsoft Clarity loads only after you accept statistics on the consent banner. Decline, and no analytics provider loads. You can change your choice in the footer. Clarity does not load on the NIS2 check.
After acceptance, analytics providers set cookies. You can withdraw consent through Change your choice in the footer; this removes first-party analytics cookies and reloads the page to stop tracking. The language preference, the last hero photograph and the consent choice are held in browser storage.
The contact form
One e-mail, nothing stored
A message from the contact form is relayed as one e-mail to the mailbox configured for enquiries, through Azure Communication Services, Europe data location, with your address as the reply-to. It is stored nowhere: no database, no CRM, no form service.
Before it is relayed: a hidden field catches automated submissions; control characters are stripped so nothing can inject a mail header; a size limit applies; the number of messages per address per ten minutes is limited; and a time trap refuses a submission made within seconds of the form being opened, which people do not do and scripts do.
- The platform keeps no access logs for this site. What a visitor reads is not recorded.
- The contact function logs that a message was relayed, never what it said or who sent it.
- The partner portal logs no request data, tokens or prices.
Hosting and access
Where it runs, and who can change it
Azure App Service (Linux), inside the European Union. The site runs as a single Node.js process that serves pre-built files and applies the response headers. The same process runs the partner portal at /partner. The platform hostname redirects to thinksmart.eu, so there is one address.
- The site is published by the repository's own pipeline on every change to its main branch. The deployment credential exists only as an encrypted secret in that repository, and nowhere else. FTP is off.
- A deployment replaces the whole site. Nothing from an earlier build stays behind.
- The partner portal at /partner accepts only Microsoft Entra accounts that belong to a group assigned to it. Its configuration, partner data and sessions are kept on the platform's storage outside the deployment, so a deployment neither removes them nor signs anyone out.
- Azure Policy refuses any resource outside European Union regions, and any resource type the site does not need.
- The production resource group carries a delete lock. Role changes, policy changes, lock removals and deletions raise an alert.
Source and dependencies
A short supply chain
The site is generated from plain text files in a private repository. The generator has build-time dependencies only; nothing from a package registry runs on the server or in your browser. The API that handles the contact form has no dependencies at all.
The editor used to change the text is served from this origin, pinned to a version and checked in, rather than loaded from a content delivery network. A third-party script with write access to a site's repository is the supply-chain shape we advise clients against.
Check it yourself
Six commands
curl -I https://thinksmart.eu/shows the headers above.curl -sI http://thinksmart.eu/ | head -1shows the redirect from plain HTTP.openssl s_client -connect thinksmart.eu:443 -tls1_1fails, as it should.dig +short thinksmart.eu DSshows the DNSSEC delegation.dig +short TXT _dmarc.thinksmart.eushows the DMARC policy.curl https://thinksmart.eu/.well-known/security.txtshows where to report a finding.
Reporting a weakness
If you find something, we want to hear it first
The route in is security.txt, and the responsible disclosure section of our terms of use says what is in scope and what we commit to in return. The address is info@thinksmart.eu.