This site is static. It has no database, no user accounts and no login, so there is very little to say here, and all of it is checkable by reading the page source.

The audit request form

The form on the request page has no server behind it. Submitting it opens your own mail client with the fields filled in, and you send the message yourself to audits@egissec.net. Nothing is transmitted anywhere until you press send in your own mail app, and what we then hold is an email, in a mailbox, containing exactly what you chose to write.

What this site does not do

No cookies are set, of any kind.
No analytics. No Google Analytics, no Plausible, no Fathom, nothing.
No tracking pixels, no ad networks, no remarketing tags.
No fingerprinting, no session recording, no heatmaps.
No third-party scripts at all. The only JavaScript is one file served from this domain, and it handles the navigation and the FAQ accordion.

The one request that leaves this domain

Three typefaces load from Google Fonts, which means your browser fetches them from fonts.googleapis.com and fonts.gstatic.com on each page view, and Google receives your IP address and user agent as part of that request. That is the only exception to everything above, and it is named here because it is the only thing on this site we do not serve ourselves. We are looking at self-hosting the files to remove it.

Server logs

The site is hosted on Netlify, which keeps ordinary web-server request logs - IP address, timestamp, path, user agent - for delivery, security and abuse handling. We do not query them to build any profile of you, and we do not join them to anything.

Links off this site

The audit record links published reports. Those are hosted by GitHub and by the contest platforms - Sherlock, Code4rena, CodeHawks, Cantina, Hats - and once you follow a link, that site is handling your visit under its own policy, not ours.

Asking about any of this

Email audits@egissec.net or message us on Telegram. If you want anything you have sent us deleted, say so and it goes.