# ISMS FAQ

Normalized answers to the questions supplier security reviews ask about icons (icon0.eu), operated by botBrains GmbH. The company-wide policy framework referenced below is public at [docs.botbrains.io/trust](https://docs.botbrains.io/trust/policies). Where this page and a generic questionnaire disagree in wording, the facts here are authoritative for this service. See also the [Compliance](/legal/compliance) page.

## Are you currently certified to ISO/IEC 27001? If yes, please provide the certificate and its scope.

No. botBrains GmbH is not ISO/IEC 27001 certified. The company is pursuing certification for its core business, and we do not claim certifications we do not have. Note that our sole subprocessor, Hetzner Online GmbH, operates ISO/IEC 27001-certified data centres - all infrastructure this service runs on is covered by that certification.

## Do you operate a formal information security management programme or ISMS?

botBrains GmbH maintains a formal security programme with a public policy framework ([docs.botbrains.io/trust/policies](https://docs.botbrains.io/trust/policies)) and is working toward ISO 27001 for its core platform. The subprocess.io services - including icons (icon0.eu) - are **not** within the scope of that ISMS. Their operation follows the published policies as company guidance, and this FAQ states the service's actual controls rather than inheriting claims from the programme.

## What information belonging to us will you access, process, store, or transmit?

For anonymous use: only the domain names you request icons for, and the resulting cached favicon images (public data by nature). Nothing about the requesting visitor is stored - no IP addresses, user agents, or referrers; rate limiting uses a salted in-memory hash whose salt rotates daily. For registered tenants we additionally store your identity-provider organisation id, the domains you claim, and their DNS verification tokens.

## In which countries/regions will our data be stored and processed?

Germany only (Hetzner Online GmbH data centres, EU). Requests are answered exclusively from the EU and data is not transferred to third countries.

## How do you control employee and administrator access to customer data?

Least-privilege access per the [Access Control Policy](https://docs.botbrains.io/trust/policies/access-control-policy): production access is limited to named botBrains operations personnel via SSH keys; there is no standing broad access, and the service holds almost no customer data to access in the first place.

## Is MFA required for privileged accounts and systems containing customer data?

Yes. Multi-factor authentication is required for privileged accounts (hosting console, DNS/registrar, identity provider administration) per the Access Control Policy.

## Is customer data encrypted in transit and at rest?

All traffic is encrypted in transit with TLS. At rest the service stores public favicon images and a minimal tenant registry on EU servers; where backups exist they are encrypted with AES-256 per the [Backup Policy](https://docs.botbrains.io/trust/policies/backup-policy).

## Are employees with access to sensitive/customer information subject to appropriate screening, confidentiality obligations, and security training?

Yes, per the [Human Resource Security Policy](https://docs.botbrains.io/trust/policies/human-resource-security-policy): screening appropriate to role, contractual confidentiality obligations, and security awareness training.

## Do you have documented vulnerability and patch-management processes?

Yes - the published [Vulnerability Management Policy](https://docs.botbrains.io/trust/policies/vulnerability-management-policy) covers identification, prioritisation, and remediation.

## Do you perform vulnerability scanning and/or penetration testing regularly?

Dependency and platform patching run continuously, and security-relevant components receive adversarial testing during development. No external penetration test has been commissioned for icon0.eu to date; we say so plainly rather than imply otherwise.

## Do you maintain and test an information-security incident-response process?

Yes, per the [Incident Management Policy](https://docs.botbrains.io/trust/policies/incident-management-policy); external reports enter it through the [Vulnerability Disclosure Policy](/legal/vulnerability-disclosure-policy).

## How quickly will you notify us of a security incident affecting our data or services?

Without undue delay after becoming aware, per the [Breach Notification Policy](https://docs.botbrains.io/trust/policies/breach-notification-policy). Where botBrains acts as controller and a breach is likely to risk individuals' rights, the supervisory authority is notified within 72 hours (GDPR Art. 33).

## Do you maintain and periodically test business continuity and disaster-recovery arrangements?

Yes, following the published [Business Continuity and Disaster Recovery policy](https://docs.botbrains.io/trust/policies/business-continuity-and-disaster-recovery). Service-specific reality: the service is stateless and its icon cache rebuilds itself from public sources, so the achievable recovery time is minutes, not days.

## Are backups performed and tested, and are they appropriately protected?

The icon cache is deliberately not backed up - it is derived, public data that rebuilds itself on demand. The tenant registry is small and reconstructible through re-verification; backup handling follows the [Backup Policy](https://docs.botbrains.io/trust/policies/backup-policy) (AES-256 at rest, TLS in transit, tested restores).

## Do you use subcontractors/subprocessors to deliver the service?

One: Hetzner Online GmbH (Germany) for hosting. See the [Subprocessor list](/legal/subprocessors).

## How do you assess the information-security risks of your own critical suppliers/subprocessors?

Per the [Supplier Management Policy](https://docs.botbrains.io/trust/policies/supplier-management-policy): suppliers are inventoried, risk-assessed before onboarding, bound by data processing agreements, and reviewed periodically.

## Will you notify us of significant changes to your service, infrastructure, subprocessors, or security controls?

Yes. Subprocessor changes are announced via the [Subprocessor list](/legal/subprocessors) with objection rights per the [DPA](/legal/data-processing-agreement); material service changes are published in the documentation.

## What security/privacy regulations and contractual requirements apply to the service?

The GDPR and German law (including § 5 DDG for provider disclosure). A GDPR Art. 28 [Data Processing Agreement](/legal/data-processing-agreement) applies automatically to every account.

## Can you provide relevant independent assurance reports, such as ISO 27001, SOC 2, penetration-test summaries, or equivalent?

Not yet for the service itself - no ISO 27001 certificate, SOC 2 report, or external penetration-test summary exists for it. Hetzner's ISO/IEC 27001 certification covers the data centres the service runs in ([hetzner.com/unternehmen/zertifizierung](https://www.hetzner.com/unternehmen/zertifizierung/)). Our compensating transparency: the full policy set is public, the architecture is documented, and this FAQ answers questionnaires honestly.

## What happens to our information when the contract ends, including deletion, return, backups, and account termination?

Tenant account deletion removes the organisation record, claimed domains, and verification tokens. Cached favicon images are public data keyed to domains, not accounts, and expire on their own schedule. There is nothing else to return - the service never accumulates visitor data.

## How do you monitor the effectiveness of your security controls and address identified deficiencies?

Following the published [Logging and Monitoring Policy](https://docs.botbrains.io/trust/policies/logging-and-monitoring-policy) - with the service-specific property that application logs contain no personal data by design (no IPs, user agents, or referrers), so monitoring covers service health, error rates, and control regressions rather than user activity.

## Have you experienced any material security incidents relevant to the service in the last 24 months? If yes, what remediation was performed?

No. No material security incidents relevant to this service.