Privacy

This page describes what actually happens, not what is legally minimal to disclose. If something here is wrong, it is a bug.

What is never stored

• Your IBAN in full. The checksum is computed in memory and discarded. If you create a shareable link, only the country code, check digits and last four characters are kept — for example DE89••••••••••••••3000. The account portion is never written anywhere.
• Your IP address. Not in a database, not in a log file. The web server's access logging is switched off deliberately.
• Any account. There is no signup, so there is nothing to associate a check with a person.
• Cookies. The site sets none, which is why there is no cookie banner.

What is stored, and for how long

Only if a check produces a shareable link. That link holds the result as displayed: the VAT number and registry response, the masked IBAN, the sanctions outcome, and the domain records. It is deleted automatically after 90 days.

Result links are unlisted, not secret. Anyone with the link can read it — that is the point of being able to forward it to whoever approves the payment. They are excluded from search engines and from the sitemap, but treat the link itself as the access control.

Rate limiting

Checks are limited to 20 per hour per IP address, to stop the tool being used to hammer the registries it depends on. Enforcing that requires counting requests per address, so a counter keyed by your IP exists in memory for up to an hour and then expires. It is never written to disk and is not associated with what you checked.

Who else sees your input

Running a check necessarily contacts third parties:

• VAT number → the EU VIES service, or HMRC for UK numbers. They see the number and this server's IP address, not yours.
• Domain → DNS lookups, resolved from this server. The domain's own nameservers see the query.
• Domain → an RDAP registry lookup for the registration age, where one is available.
• IBAN → nobody. The checksum is arithmetic and is computed here. It is never sent anywhere.
• Company name → nobody. Sanctions screening runs against a copy of the EU list held on this server.

Analytics

Page views are counted with a self-hosted, cookieless analytics install running on the same machine. It records the path visited, the referring site and a coarse device type. It does not store IP addresses, and visitors are identified by a rotating server-side hash rather than anything persistent. Query strings are stripped before a view is recorded, because they can contain a VAT number or a domain.

A few events are also recorded so it is possible to tell whether the tool actually works for people: that a check was started, that it finished, that it failed, that a guide was read, that a shared result was opened. These carry only shapes — which of the four fields were filled in, and which statuses came back (for example "valid", "service unavailable", "no match").

They never carry anything you typed. No VAT number, no IBAN — not even the masked form — no domain, no company name. Result links are recorded as/result with the identifier removed, so the analytics data cannot be used to open anyone's saved check.

Where this runs

On a single server in Helsinki, Finland, inside the EU. Nothing is on a third-party cloud platform, and the database is on the same machine as the application.

Removing a result

Results expire on their own after 90 days. If you need one gone sooner, get in touch via the about page with the link.