What we collect

• No accounts, forms or sign-ups. There is nothing to register for and no field that asks for your name or email.
• No cookies. This site sets none, so there is no cookie banner because there is nothing to consent to. The one thing kept in your browser is your theme choice (dark, light or high contrast), and only if you change it from the menu. It is stored locally on your device and is never sent to us.
• No analytics, trackers, ads or fingerprinting.
• No third-party requests. Fonts, icons and scripts are all served from lowersideband.eu itself, so no outside company learns that you visited.
• No access logs. Our web server and API are configured not to record visitor IP addresses or the pages you request.

The security auditor

When you run a scan, the domain you type is sent to our server, which connects to that domain, reads its public TLS certificate, HTTP headers and DNS records, and sends the result back to you. The domain and the result are kept in memory only for the duration of the request. They are not written to disk, logged or stored.

Only scan domains you own or have permission to test. The scan makes ordinary public requests, similar to a browser visit.

Badges

If a site embeds a Lowersideband badge, the visitor's browser requests a small image from our server. We do not log that request. To make badges load quickly, the grade for a scanned domain is kept in server memory for up to an hour and then dropped. It is never written to disk. A badge shows the latest scan of a domain and does not prove who owns it.

The tools

The NIS2 scope check, ISO 27001 checklist, breach timer and password checker run entirely in your browser. What you type or tick never leaves your device and is not stored.

Rate limiting

To stop abuse, the auditor and the badge service allow a limited number of scans per minute per visitor. To do that, your IP address is held in the server's memory for a couple of minutes. It is never written to disk and is discarded automatically, or when the service restarts. This is our legitimate interest in keeping the service available (GDPR Art. 6(1)(f)), and it is not used for anything else.

Share links and PDF reports

A share link contains the whole report inside the part of the address after the #. Browsers never send that part to a server, so we never see or keep the report. Anyone you give the link to can read it. "Save as PDF" is produced by your own browser.

Who runs this site

Lowersideband is an independent passion project run by one person, a cyber security professional and Navy veteran, and paid for out of their own pocket. There are no advertisers, sponsors or investors, and no one else receives any data about you, because none is collected.

Hosting and your rights

The site is hosted on a server with Hetzner in Germany. Because we do not keep personal data about visitors, there is nothing to access, correct, export or delete. If you believe otherwise, your rights under the GDPR still apply, and you may lodge a complaint with your national data protection authority.

Last updated: October 2026