Security

Last updated: October 2026

What we do

• Encrypted: The website is only available over HTTPS. Browsers are told never to use an unencrypted connection (HSTS).
• Security headers: A strict content security policy only allows content from our own domain. On the booking page, the anny booking tool is allowed as well.
• No tracking: No tracking or advertising cookies, no social media plugins. Visitor statistics are cookie-free and anonymous.
• Little data: There is no login and no database on the website. Contact requests reach us as email, newsletter addresses are stored at Brevo, bookings at anny.
• Spam protection: Forms have an invisible protection against automated submissions.
• Accounts: Access to hosting, code and domain is protected with two-factor authentication.
• Location: The website is delivered through Vercel's worldwide network. The contact form and newsletter sign-up run on servers in Frankfurt.

Found a vulnerability?

Thank you for helping. Write to ciao@noybern.ch with a short description and, if possible, the steps to reproduce it. Please do not access other people's data or disrupt the service. We will get back to you as soon as possible.

Machine-readable contact details are at /.well-known/security.txt.