Compliance#
This page answers the questions supplier reviews and ISMS checklists usually ask. Short version: everything runs in Germany on Hetzner, and the service is built so that data about the people loading icons never exists at rest - no IP logs, no user-agent logs, no referrer logs, ever - and we do not claim certifications we do not have.
Server location#
All production systems, including our self-hosted identity service, run on Hetzner Online GmbH servers in Germany (EU). There is no CDN, no US cloud, no third-party analytics, and no advertising or tracking. Icon requests are answered exclusively from the EU; personal data is not transferred to third countries. TLS certificates come from Let's Encrypt, which receives only domain names during issuance. Hetzner is our sole subprocessor (hosting) - see the Subprocessor list. Processing is subject to the GDPR.
Privacy by design#
The icon endpoints are designed so that invasive data never exists at rest: requests are not logged - no IP addresses, user agents, or referrers. For rate limiting only, the request's IP address is reduced in memory to a salted, truncated hash; the salt rotates every day at 00:00 UTC and the counters live only in memory - they are never written to disk, and after the rotation not even we can connect yesterday's hash to today's. This is the only per-visitor state in the entire system, and it requires no consent: EU law recognizes processing strictly necessary and proportionate for network and information security as a legitimate interest (Art. 6(1)(f) with Recital 49 GDPR). The icon cache holds only public favicon data per domain, and the application database (SQLite) holds only tenant organization IDs and the domains tenants claimed. There is no way to answer "which sites did visitor X look up" - that information is never recorded.
Encryption#
All traffic is encrypted in transit with TLS; certificates are issued and renewed automatically. Verification tokens for domain claims are random, single-purpose values with no personal content.
Access control#
Customer sign-in for the console runs through our self-hosted identity service (OIDC with PKCE) supporting second factors. Tenants are isolated at the application layer; every management-API query is scoped to the authenticated tenant. The public icon endpoints require no authentication by design and expose only public favicon data.
Data retention#
The full picture is in the Privacy policy; the summary: icon requests are not recorded at all, in-memory rate-limit state vanishes daily, cached icons (no personal data) are refreshed on a rolling basis, and account data plus claimed domains live for the lifetime of the account.
Availability#
icons is currently a free service without a formal SLA. Responses are aggressively cacheable (24-hour max-age with 7-day stale-while-revalidate and strong ETags), so short interruptions on our side are largely absorbed by your users' browser caches. Operational backups, where they exist, stay on EU infrastructure and contain no visitor data - there is none to back up.
Backups and disaster recovery#
The icon cache is derived, public data: it is intentionally not backed up because it rebuilds itself on demand from the source websites. The tenant registry is small and reconstructible through re-verification; where backups exist they follow the published botBrains Backup Policy (AES-256 at rest, TLS in transit, tested restores) and stay on EU infrastructure. The service itself is stateless, so disaster recovery is redeployment; the achievable recovery time is minutes.
Logging and monitoring#
Application logs contain no personal data by design: no IP addresses, user agents, or referrers, ever. Monitoring therefore covers service health, error rates and control regressions rather than user activity, following the published Logging and Monitoring Policy.
Incident response and breach notification#
Security events, including reports arriving through the Vulnerability Disclosure Policy, are handled per the published Incident Management Policy. Affected customers are notified without undue delay; where botBrains acts as controller and a breach risks individuals' rights, the supervisory authority is notified within 72 hours (Art. 33 GDPR), per the Breach Notification Policy.
Personnel and confidentiality#
Access to production is limited to named botBrains operations personnel. Personnel are subject to contractual confidentiality obligations, role-appropriate screening and security awareness training per the published Human Resource Security Policy.
Penetration testing#
No external penetration test has been commissioned for this service yet; we state that plainly rather than imply otherwise. Security-relevant components receive adversarial testing during development, and the Vulnerability Disclosure Policy invites external researchers with safe harbour.
Funding and stewardship#
icons is built and operated by botBrains GmbH, a bootstrapped German company. The service is deliberately cheap to run (one binary, aggressive caching) and is not dependent on venture funding or advertising revenue to continue existing. There is no business model that would ever require monetizing visitor data: there is none.
Carbon footprint#
All infrastructure runs in Hetzner data centres in Germany, which are powered by renewable energy (hydropower and wind). The service's design minimizes its footprint: tiny PNGs, immutable caching that lets browsers absorb most traffic, and a single small binary per host.
Migration and data export#
There is no lock-in to migrate away from. Icon URLs are plain HTTPS GETs you can point at any other resolver; your tenant data amounts to the list of domains you verified, visible in the console at any time. On request we export it as JSON.
Account deletion#
Deleting your account removes the organisation record, claimed domains and verification tokens. Cached favicon images are public data keyed to domains, not accounts, and expire on their own schedule. Nothing else exists to delete: the service never accumulates visitor data.
Certifications#
We hold no ISO 27001 or SOC 2 certification ourselves and do not claim any. Our sole subprocessor, Hetzner Online GmbH, operates ISO/IEC 27001-certified data centres (certification) - all infrastructure this service runs on is covered. botBrains GmbH, our operator, publishes its security policy framework at docs.botbrains.io/trust and is pursuing ISO 27001 for its core business; this service is not within that ISMS scope and follows the published policies as guidance.
Vulnerability disclosure#
Please see the Vulnerability Disclosure Policy - reports go to security@icon0.eu, with safe harbour for good-faith research.
Security questionnaires (ISMS FAQ)#
We answer the questions supplier reviews ask - honestly, in one place - in our ISMS FAQ.
Due to capacity constraints we ask that you do not send your own questionnaire but use our normalized ISMS questionnaire. Please ask your AI of choice to match your questions and flag if there is missing content, using this prompt:
"I need to fill out my companies isms security questionaire, it is attached. We'll be using the icons service. They provide answers to most questions at https://icon0.eu/legal/isms-faq.md and https://icon0.eu/legal/compliance.md. Please fill out my questionaire from that information. If one question cannot be answered, point it out to me later. Sometimes, reading https://icon0.eu/docs can help resolve open questions not answered. Try to complete the full questionaire."
Data processing agreement#
Where embedding icons on your site is considered processing on your behalf, you are the controller and we are the processor. The Data processing agreement is our agreement under Art. 28 GDPR and applies automatically to every account; a countersigned copy is available on request via the contact address in the Imprint.
Last updated: August 2026.