Germany security reports

I

InterNations

internations.org

66

InterNations is a leading global community platform for expatriates, offering networking, events, and destination guides across 420 cities worldwide. The website targets expatriates and global minds seeking connection and information about living abroad. Technically, the site employs modern JavaScript frameworks, Webpack bundling, and integrates monitoring and analytics tools such as New Relic, Google Analytics, and Cookiebot for consent management. Hosting is via Cloudflare CDN, ensuring performance and availability. Security posture is weakened by the absence of a valid SSL certificate and disabled TLS protocols, despite good security header configurations and secure cookie practices. Privacy compliance is strong, with clear privacy and cookie policies and consent mechanisms. Overall, the site is professional and trustworthy but requires urgent SSL/TLS remediation to improve security and user trust.

L

Landitec GmbH

scope7.de

40

scope7.de is the online presence of Landitec GmbH's scope7® brand, specializing in hardware appliances tailored for open source solutions such as OPNsense®, flexiWAN, IPFire, Untangle®, and FRRouting. The company positions itself as a provider of powerful, cost-effective, and ready-to-use hardware platforms that are pre-installed with popular open source firewall and routing software. Their market position is strengthened by official certifications and partnerships, notably as an OPNsense Platinum Partner and flexiWAN certified hardware provider. The website reflects a professional and consistent brand image targeting businesses and professionals seeking vendor-independent open source security appliances. Technically, the site is built on Joomla CMS with modern frontend libraries and extensions, delivering good performance and mobile optimization. Security posture is solid with HTTPS enforced, HSTS header present, and no detected SSL vulnerabilities, though improvements like OCSP stapling and DNSSEC could enhance security further. Privacy compliance is well addressed with a clear privacy policy and cookie consent mechanism, aligning with GDPR requirements. Contact information is available with a clear company phone number and contact forms, supporting business credibility. Overall, the website demonstrates a mature digital presence with strong business and security fundamentals.

G

Gaia-X 4 Future Mobility

gaia-x4futuremobility.de

40

Gaia-X 4 Future Mobility is a collaborative project family focused on developing and implementing future mobility applications based on the Gaia-X initiative. It is funded by the German Federal Ministry for Economic Affairs and Climate Action and coordinated by the DLR Institute for AI Security. The initiative involves about 80 participants from industry and research, aiming to build an open, decentralized data and service ecosystem for mobility. The website provides detailed information about the six constituent projects, their goals, participants, and related initiatives. Technically, the site is built on the Webflow platform, uses Google Fonts and jQuery, and is hosted on a CDN. However, the site lacks a valid SSL certificate and does not enforce HTTPS, which is a critical security concern. Privacy and terms of service pages are present, but no cookie consent mechanism is detected. Overall, the site is professionally designed with good content relevance and navigation but requires urgent security improvements.

P

Papoo Software & Media GmbH

epccm19.com

66

Papoo Software & Media GmbH operates the CCM19 Cookie Consent Manager, a comprehensive European alternative for cookie consent management software. The company offers multiple deployment options including on-premise, cloud, and agency versions, emphasizing data sovereignty by hosting all infrastructure in Germany. The website demonstrates a strong market position with extensive features, multilingual support, and a clear focus on compliance with GDPR, TDDDG, and other privacy regulations. The business targets website owners, agencies, and enterprises requiring robust consent management solutions. Technically, the site uses a modern stack with Apache, PHP, jQuery, and Foundation framework, hosted by Your-Server.de. Security posture is solid with HTTPS, security headers, and no known vulnerabilities, though some improvements like enhanced HSTS and CSP headers are recommended. Overall, the site is professional, well-structured, and trustworthy, with clear contact information and certifications. The privacy and cookie policies are comprehensive and GDPR compliant, supporting a positive privacy compliance score.

H

Hochschule Ruhr West

hs-ruhrwest.de

40

Hochschule Ruhr West is a public university of applied sciences located in the Ruhr region of Germany, with campuses in Mülheim an der Ruhr and Bottrop. The institution offers a broad range of degree programs including bachelor, master, part-time, and dual studies, alongside active research and transfer activities. The website reflects a well-established regional educational institution with a clear focus on accessibility, student services, and cooperation with industry and society. The target audience includes prospective and current students, academic staff, and business partners. Technically, the website employs modern web technologies including JavaScript, CSS, and Cookiebot for cookie consent management, and integrates Google Tag Manager for analytics and marketing. The content management system appears to be Ibexa, supporting a structured and navigable site architecture. Performance is moderate with a page load time of approximately 6 seconds and a page size of about 335 KB. The site is mobile-optimized and accessible with good SEO practices. From a security perspective, the site lacks a valid SSL/TLS certificate and does not serve content over HTTPS, which is a critical vulnerability impacting user trust and data protection. No modern TLS protocols or security headers are detected, and HSTS is not enabled. DNS records show proper SPF and DMARC configurations, which help mitigate email spoofing risks. Cookie consent is implemented comprehensively, supporting GDPR compliance. However, no explicit security policy or incident response information is found. Overall, the website is professionally designed and content-rich but suffers from significant security shortcomings due to the absence of HTTPS. Strategic improvements in SSL deployment, security headers, and incident response transparency are recommended to enhance trust and compliance.

Z

ZENIT GmbH (Konsortialführerin), NRW.BANK (Konsortialpartnerin), NRW.Global Business GmbH, IHK NRW e.V.

nrweuropa.de

35

NRW.Europa is a regional representation of the Enterprise Europe Network in North Rhine-Westphalia, Germany, providing comprehensive support for internationalization, innovation, and funding to SMEs and research institutions. The website is built on TYPO3 CMS and features professional design, clear navigation, and multilingual support. However, the site lacks a valid SSL certificate and modern TLS protocols, which significantly impacts its security posture. While privacy compliance is well addressed through a cookie consent mechanism and a comprehensive privacy policy, the absence of HTTPS and other security headers poses risks. The site maintains active content with news and event calendars, reinforcing its credibility and engagement with its audience. Strategic improvements in SSL deployment and security configurations are critical to enhance trust and compliance.

J

Jugend will sich-er-leben (JWSL)

jwsl.de

40

Jugend will sich-er-leben (JWSL) is a German non-profit prevention program focused on occupational safety and health for apprentices. It provides educational materials, competitions, and media resources primarily targeting vocational schools, teachers, and training companies. The program is affiliated with the statutory accident insurance and the DGUV, positioning it as a recognized entity in the education and government sectors within Germany. Technically, the website is built on TYPO3 CMS with modern frontend frameworks like Bootstrap and uses Video.js for media playback. However, the site suffers from a critical security deficiency as it lacks a valid SSL certificate and does not support HTTPS, exposing users to potential risks. Privacy compliance is addressed with a cookie consent mechanism and a privacy policy, but no terms of service or incident response contacts are found. Overall, the site offers good content and user experience but requires urgent security improvements.

B

Berufsgenossenschaft Rohstoffe und Chemische Industrie

bgrci.de

40

Berufsgenossenschaft Rohstoffe und Chemische Industrie (BG RCI) is a statutory accident insurance institution in Germany serving sectors such as mining, chemical industry, paper manufacturing, leather, sugar, and construction materials. The organization provides accident insurance, prevention, rehabilitation, and consulting services focused on occupational safety and health. The website targets entrepreneurs and insured members within these industries, offering information, publications, and access to online services such as a member portal. The site is built on TYPO3 CMS and uses modern JavaScript libraries and Matomo for analytics, indicating a moderate level of digital maturity. However, the website suffers from a critical security deficiency due to the absence of a valid SSL certificate and HTTPS support, exposing users to potential data interception risks. Privacy compliance is well addressed with a comprehensive privacy policy and GDPR adherence, but cookie consent mechanisms are missing. Overall, the site is content-rich and professionally designed but requires urgent security improvements to protect user data and enhance trust.

B

Berufsgenossenschaft Energie Textil Elektro Medienerzeugnisse (BG ETEM)

bgetem.de

40

Berufsgenossenschaft Energie Textil Elektro Medienerzeugnisse (BG ETEM) is a German statutory accident insurance institution serving sectors including energy, textiles, electronics, and media. The organization provides prevention, rehabilitation, compensation, and member services to insured companies and individuals. The website reflects a well-structured, content-rich platform targeting employers, insured persons, and safety professionals with comprehensive information and resources. Technically, the site is built on the Plone CMS with Bootstrap and jQuery, integrating Matomo analytics and Cookiefirst for consent management. However, the site lacks HTTPS encryption, which is a critical security deficiency. No security headers or modern TLS protocols are configured, exposing the site to potential risks. Privacy and legal compliance are well addressed with clear policies and cookie consent mechanisms. Overall, the site is professional and trustworthy but requires urgent security improvements to protect user data and ensure compliance with modern standards.

B

BG Verkehr

bg-verkehr.de

40

BG Verkehr is a German statutory accident insurance institution specializing in transportation and logistics sectors. The website provides comprehensive information about insurance coverage, prevention, rehabilitation, and training services tailored for employees and companies in these industries. The site targets German-speaking users and serves as an official communication channel for BG Verkehr's services and updates. Technically, the website is built on the Plone CMS platform, utilizing modern frontend libraries such as Bootstrap and Font Awesome, and integrates Piwik/Matomo for analytics and Cookiefirst for cookie consent management. However, a critical security shortfall is the absence of a valid SSL certificate and HTTPS support, exposing users to potential risks and undermining trust. The site lacks security headers and advanced SSL configurations, which further impacts its security posture. Privacy compliance is well addressed with clear privacy and cookie policies and a consent mechanism. Overall, the website is professionally designed with good content quality and navigation but requires urgent security improvements to meet modern standards.

B

BG Kliniken – Klinikverbund der gesetzlichen Unfallversicherung gGmbH

bg-kliniken.de

40

BG Kliniken is a large non-profit healthcare organization in Germany specializing in acute care and rehabilitation for severely injured and occupationally ill patients. It operates one of the largest trauma center networks in the country, offering comprehensive medical services, research, and professional training through its BG Kliniken Akademie. The website is professionally designed with clear navigation targeting patients, insurance carriers, referring physicians, and job applicants. Technically, the site is built on TYPO3 CMS and integrates modern tools such as Usercentrics for cookie consent and Google Tag Manager for analytics. However, the site suffers from a critical security deficiency due to the absence of a valid SSL certificate and HTTPS support, exposing visitors to potential risks. DNS records show well-configured SPF and DMARC policies, enhancing email security. Overall, the site demonstrates strong business credibility and privacy compliance but requires urgent security improvements.

V

Versicherer im Raum der Kirchen

vrk.de

40

Versicherer im Raum der Kirchen (VRK) is a medium-sized German insurance provider specializing in sustainable and ethical insurance products tailored for individuals and church-related groups. The company offers a broad range of insurance services including auto, travel, home, liability, legal protection, health, and retirement products, with a strong emphasis on sustainability and customer-centric service. Their market position is niche but well-established within the church and non-profit sectors in Germany, supported by multiple sustainability and employer awards. Technically, the website is built on Adobe Experience Manager (AEM) and uses modern web technologies such as StencilJS components and responsive images. However, the site suffers from slow load times and lacks a valid SSL certificate, serving content over HTTP which significantly impacts security posture. Accessibility and SEO optimizations are well implemented, and the site is mobile-friendly with clear navigation. Security-wise, the absence of HTTPS and security headers is a critical weakness, exposing users to potential risks. No explicit security or incident response policies are found, and no vulnerability disclosure or security.txt files are present. Privacy compliance is strong with a comprehensive privacy policy and cookie consent mechanism in place. Overall, VRK's website demonstrates excellent content quality and business credibility but requires urgent improvements in security infrastructure to protect user data and enhance trust. Strategic recommendations include implementing HTTPS, adding security headers, and improving performance to align with best practices.

F

Förderverein der Meister- und Techniker aus- und -fortbildung im saarländischen Handwerk e.V.

foerderverein-mts.de

40

The Förderverein der Meister- und Techniker aus- und -fortbildung im saarländischen Handwerk e.V. is a small non-profit association dedicated to supporting master craftsman and technician education in the Saarland region of Germany. Their activities include financial support for educational trips, fostering cross-border economic relationships, awarding excellence in master and technician works, marketing support, and lobbying efforts. The website is professionally designed using modern technologies such as Gatsby and React, hosted on Netlify, and provides clear organizational and contact information. However, the site lacks HTTPS security, which is a critical vulnerability. No privacy or cookie consent mechanisms are present, and no advanced security policies or incident response information is disclosed. Overall, the site serves its informational purpose well but requires significant improvements in security and privacy compliance to meet modern standards.

H

Handwerkskammer des Saarlandes

handwerkerforum-saar.de

40

Handwerkerforum Saar is a regional non-profit association affiliated with the Handwerkskammer des Saarlandes, focused on supporting and developing the local crafts and trades community. The website offers information about events, workshops, and networking opportunities aimed at handwerk businesses and apprentices in the Saarland region. The technical infrastructure is based on a custom or proprietary CMS platform with common web technologies such as Bootstrap and jQuery. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a significant security concern. The cookie consent mechanism indicates some level of GDPR compliance, but no explicit security or incident response policies are present. Overall, the website provides relevant business content but suffers from technical and security shortcomings that should be addressed to improve trust and compliance.

S

Saar-Lor-Lux Umweltzentrum GmbH

saar-lor-lux-umweltzentrum.de

40

The Saar-Lor-Lux Umweltzentrum GmbH is a regional environmental consultancy affiliated with the Handwerkskammer des Saarlandes, focused on providing free and paid environmental and energy consulting services to craft businesses in the Saar-Lor-Lux region. Their key offerings include environmental consulting, energy advice, regional development, and training programs aimed at supporting sustainable business practices and energy efficiency. The website is built on TYPO3 CMS and uses modern JavaScript libraries, with a clear structure and good content quality targeting German-speaking users. However, the technical infrastructure shows significant security weaknesses, notably the absence of a valid SSL certificate and HTTPS support, which critically impacts the site's security posture. Privacy compliance is addressed through a visible privacy policy and a consent management platform (Usercentrics), and analytics are handled via a self-hosted Matomo instance with user consent. Overall, the site is functional and professional but requires urgent improvements in SSL/TLS configuration and security best practices to enhance trust and protect user data.

I

Initiative #WirtschaftHilft (BDA, BDI, DIHK, ZDH)

wirtschafthilft.info

45

The website 'WirtschaftHilft' is a collaborative initiative by major German economic associations (BDA, BDI, DIHK, ZDH) aimed at supporting companies and society in managing the impacts of the Russia-Ukraine conflict. It serves as a comprehensive information hub providing resources on humanitarian aid, economic sanctions, reconstruction efforts, and labor market integration for Ukrainian refugees. The platform targets German businesses and stakeholders involved in Ukraine-related economic activities, positioning itself as a central coordination and information point backed by reputable organizations. Technically, the site is built on WordPress 6.8.1 with PHP 8.0.30 and uses plugins such as LayerSlider and Borlabs Cookie for enhanced user experience and privacy compliance. The hosting is managed by United Domains AG. While the site offers rich content, multimedia, and good mobile optimization, its performance is slow and accessibility is basic. SEO practices are adequately implemented. From a security perspective, the site lacks a valid SSL certificate and does not support HTTPS, which is a critical vulnerability. No modern TLS protocols or security headers are configured, exposing the site to potential risks. However, cookie consent management is robust, and no exposed sensitive data or vulnerable libraries were detected. Overall, the site is professional and trustworthy in content and business credibility but requires urgent security improvements, especially regarding HTTPS implementation, to ensure user safety and compliance with best practices.

V

Verband Deutscher Hidden Champions

verband-deutscher-hidden-champions.de

40

The Verband Deutscher Hidden Champions e.V. (VDHC) is a German-based association representing medium-sized enterprises known as Hidden Champions. The organization focuses on fostering international networking, knowledge exchange, and visibility for its members, who are specialized SMEs with global market presence. The website is professionally designed, content-rich, and targets business leaders and decision-makers within this niche. Technically, the site is built on WordPress with modern plugins for SEO, forms, and cookie management, but lacks a valid SSL certificate, which impacts its security posture negatively. Privacy compliance is well addressed with a comprehensive privacy policy and cookie consent mechanism. However, the absence of HTTPS and modern TLS protocols poses significant security risks. Overall, the site is credible and functional but requires urgent security improvements to protect user data and enhance trust.

B

Bundesverband betriebliche Weiterbildung - Wuppertaler Kreis e.V.

wkr-ev.de

40

The Wuppertaler Kreis e.V. is a German non-profit association representing 52 leading institutes in the business education and continuing professional development sector. Founded in 1955, it serves as a national umbrella organization advocating for workplace learning, qualification, and workforce development. The website reflects a well-structured and content-rich platform targeting business leaders and education providers, offering news, events, and member information. Technically, the site is built on TYPO3 CMS and hosted on a German provider, but suffers from critical security shortcomings due to the absence of HTTPS and a valid SSL certificate. This significantly undermines the security posture despite good content and business credibility. No cookie consent mechanism or advanced privacy compliance features are present, though a privacy policy and terms of service are available. Overall, the site is professional but requires urgent security upgrades to protect user data and improve trust.

D

DIHK-Gesellschaft für berufliche Bildung - Organisation zur Förderung der IHK-Weiterbildung gGmbH

dihk-bildungs-gmbh.de

40

DIHK-Bildungs-gGmbH is a German vocational education and training organization affiliated with the IHK and AHK networks, providing a wide range of standardized and innovative training, certification, and examination services. The website reflects a well-structured and content-rich platform targeting IHK and AHK employees as well as individuals seeking professional development. Technically, the site employs modern JavaScript modules, lazy loading, and integrates Matomo analytics and Usercentrics for consent management, hosted on SchlundTech infrastructure. However, the security posture is weakened by an invalid or missing SSL certificate and disabled TLS protocols, which significantly impacts secure communications. Privacy compliance is strong with clear privacy and cookie policies and consent mechanisms. Contact information and partner links are clearly presented, enhancing business credibility.

D

DIHK Service GmbH

dihk-service-gmbh.de

40

DIHK Service GmbH is a project company affiliated with the German Chambers of Industry and Commerce (DIHK), serving as a key partner for IHKs, AHKs, and member companies. The organization focuses on developing and implementing projects that strengthen businesses and provide societal benefits, including workforce development, education, environmental protection, and sustainable business locations. The website reflects a medium-sized government/non-profit entity with a clear business model centered on state-funded projects and partnerships. Technically, the site uses standard web technologies and etracker analytics but suffers from slow performance and lacks a valid SSL certificate, which is a critical security concern. Privacy compliance is well addressed with a cookie consent mechanism and a comprehensive privacy policy. However, the absence of HTTPS and security headers significantly weakens the security posture. Overall, the website is professional and content-rich but requires urgent security improvements to protect user data and enhance trust.

P

PIER PLUS

pier-plus.de

40

PIER PLUS is a collaborative platform fostering cooperation among universities and research institutes in the Hamburg metropolitan region. It supports six research profiles and provides news, events, and a members area to facilitate networking and joint research efforts. The website is professionally designed with clear navigation and targets academic and research stakeholders in Hamburg. Technically, the site uses JavaScript libraries such as jQuery and sliders like Swiper and Slick, hosted by the University of Hamburg's computing center. However, the site suffers from a critical security deficiency: it lacks a valid SSL/TLS certificate, resulting in unencrypted HTTP access and no HTTPS enforcement. Additionally, no security headers or cookie consent mechanisms are present, which weakens its security and privacy posture. Analytics are implemented via Piwik (Matomo) and Etracker, indicating moderate user tracking. Overall, while the content and business presentation are excellent, the technical and security implementations require urgent improvements to protect user data and enhance trust.

H

Hamburg Innovation

hamburginnovation.de

35

Hamburg Innovation GmbH is a medium-sized innovation and technology transfer company based in Hamburg, Germany, founded in 2004. It serves as a bridge between academic research and practical application by connecting universities with businesses, policymakers, and society to foster innovation. The company offers consulting, mediation, and coordination services to support knowledge transfer, spin-offs, and new technologies. Technically, the website is built on WordPress with Elementor and Slider Revolution, providing a professional and content-rich user experience. However, the absence of a valid SSL certificate and HTTPS implementation represents a critical security vulnerability. Privacy and cookie policies are well implemented with consent mechanisms, and contact information is clearly provided. The site uses Matomo for analytics, indicating a privacy-conscious approach. Overall, the website is professional and trustworthy but requires urgent security improvements to protect user data and enhance trust.

H

Hamburg Open Online University

hoou.de

40

Hamburg Open Online University (HOOU) is a well-established non-profit educational initiative supported by Hamburg's universities and governmental bodies. It offers a wide range of open educational resources, including podcasts, videos, events, and online learning modules, targeting a broad audience from students to lifelong learners. The platform is built on WordPress with modern technologies and demonstrates good content quality, accessibility, and SEO practices. However, the absence of a valid SSL/TLS certificate is a critical security gap, exposing users to potential risks. The site integrates privacy-conscious analytics (Matomo) and marketing tools (Sendinblue, Brevo) with appropriate consent mechanisms. Overall, HOOU presents a professional and trustworthy educational platform with strong academic partnerships but requires urgent security improvements to protect user data and enhance trust.

H

Hamburg Institute for Innovation, Climate Protection and Circular Economy GmbH

hiicce.de

40

Hamburg Institute for Innovation, Climate Protection and Circular Economy GmbH (HiiCCE) is a specialized institute focused on advancing the circular economy and climate protection through integrated environmental consulting, project development, and research. The organization serves a diverse clientele including corporations, NGOs, government entities, and international organizations, positioning itself as a national and international pioneer in sustainable resource management. The website reflects a professional digital presence built on WordPress with multilingual support and SEO optimization, although performance data is limited. Security posture is weak due to the absence of HTTPS and modern TLS protocols, exposing the site to potential risks. Privacy compliance is strong with comprehensive cookie and privacy policies and consent mechanisms in place. Contact information is clearly presented, enhancing business credibility.

N

NIT Northern Institute of Technology Management gGmbH

nithh.de

40

NIT Northern Institute of Technology Management gGmbH is a private business school affiliated with the Hamburg University of Technology (TUHH), specializing in MBA and Master's programs focused on Technology Management and Business Analytics & AI. Established in 1998, it serves an international student body with a practice-oriented curriculum and a faculty drawn from global institutions. The website is professionally designed and content-rich, targeting engineers and technology enthusiasts seeking management education. Technically, the site is built on HubSpot CMS and hosted behind Cloudflare, but it suffers from a critical security flaw due to the absence of a valid SSL certificate, resulting in no HTTPS support. Security headers are partially implemented, but modern TLS protocols and session security features are missing. Privacy compliance is basic, with a privacy policy present but no cookie consent mechanism or GDPR indicators. Contact information is clearly provided, enhancing business credibility. Overall, the site offers a strong educational brand presence but requires urgent security improvements to protect user data and trust.

T

Tutech Innovation GmbH

tutech.de

33

Tutech Innovation GmbH is a medium-sized company operating as a technology and knowledge transfer entity, bridging academia and industry primarily in Hamburg, Germany. It is a subsidiary of the Technische Universität Hamburg and the Free and Hanseatic City of Hamburg, with over 30 years of experience. The company offers services including research management, intellectual property management, startup support, consulting, and educational seminars through its Tutech Academy. The website is professionally designed using WordPress and Elementor, featuring comprehensive content targeted at scientific, economic, and societal stakeholders. Technically, the site uses modern web technologies but lacks a valid SSL certificate, resulting in no HTTPS support, which is a critical security flaw. Security headers are minimal, and no advanced security policies or incident response information is publicly available. Privacy compliance is well addressed with a comprehensive privacy policy and cookie policy, and Matomo analytics is used with privacy considerations. Overall, the site demonstrates strong business credibility but requires urgent security improvements to protect user data and enhance trust.

F

Forschungsfabrik Mikroelektronik Deutschland

fmd-insight.de

33

FMD.insight is a specialized news platform operated by the Forschungsfabrik Mikroelektronik Deutschland, focusing on microelectronics research and innovation in Germany. It provides news, interviews, tutorials, and a virtual showroom to engage its target audience of researchers and industry professionals. The website is built on WordPress and uses various plugins including Matomo for analytics. While the content quality and user experience are good, the site lacks HTTPS support, which is a critical security deficiency. No cookie consent mechanism is present despite the use of tracking analytics, indicating partial privacy compliance. Contact information is available but email is obfuscated to prevent scraping. Overall, the site is professional but requires urgent security improvements.

J

Just a moment...

toubiz.de

30

The website toubiz.de is currently inaccessible due to a Cloudflare Web Application Firewall (WAF) security challenge page that blocks access to actual content. As a result, no business information, contact details, or policy documents are available for analysis. The site lacks a valid SSL/TLS certificate, which severely impacts its security posture and trustworthiness. The technical infrastructure relies on Cloudflare for hosting and security, but the absence of HTTPS and modern TLS protocols is a critical vulnerability. Analytics are limited to Cloudflare Insights with minimal tracking. Overall, the site is not usable for end users in its current state, and the lack of content prevents meaningful SEO, accessibility, or privacy compliance evaluation.

G

Grover Deutschland GmbH

getgrover.com

69

Grover Deutschland GmbH operates a leading e-commerce platform specializing in flexible monthly rentals of consumer electronics, including smartphones, laptops, cameras, gaming consoles, and smart home devices. The company emphasizes sustainability by promoting reuse and reducing electronic waste through its rental model. Their market position is strong in Germany and select European countries, supported by a comprehensive product catalog and partnerships with major tech brands. Technically, the website is built on modern frameworks like Next.js and React, hosted on Cloudflare, and integrates various marketing and analytics tools such as Datadog, Braze, and Intercom. Security measures include HTTPS with strong headers, though improvements like enabling HSTS preload and DNSSEC are recommended. Privacy compliance is robust with clear policies and consent mechanisms. Overall, Grover presents a professional, trustworthy, and user-friendly digital presence with a solid security posture.

F

freenet DLS GmbH

mobilcom-debitel.de

40

Freenet DLS GmbH operates mobilcom-debitel.de, a major German telecommunications retail website offering mobile tariffs, devices, and related services. The company targets German consumers seeking mobile phone plans and devices, positioning itself as a comprehensive provider with a broad product portfolio. The website demonstrates a mature digital infrastructure leveraging Cloudflare CDN, modern JavaScript libraries, and personalization tools like Kameleoon. Security posture is strong with HTTPS, valid SSL certificates, SPF and DMARC email protections, and secure cookie settings, though some improvements are recommended such as enabling HSTS in SSL config and adding CSP headers. Privacy compliance is moderate due to the absence of explicit privacy and cookie policies or consent mechanisms. Overall, the site is professional, well-branded, and trustworthy with good SEO and user experience.

E

Endosane Pharmaceuticals GmbH

endosane.com

62

Endosane Pharmaceuticals GmbH is a small healthcare-focused biopharmaceutical company specializing in innovative mental health treatments targeting the endocannabinoid system. Founded in 2021 and based in Berlin, Germany, the company leverages deep neuroscience insights to address unmet needs in psychiatric disorders such as schizophrenia and PTSD. Their business model centers on research and clinical trial development, positioning them as a niche innovator in mental health therapeutics. The website reflects a professional and consistent brand presence with clear navigation and relevant content aimed at patients, healthcare professionals, investors, and caregivers. Technically, the site is built on Squarespace using common web libraries like jQuery and Popper.js, but suffers from slow performance and lacks advanced analytics or marketing tracking. Security posture is weak due to the absence of a valid SSL certificate and modern TLS protocols, exposing the site to risks and undermining user trust. Privacy compliance is basic, with a privacy policy and cookie banner present but no GDPR-specific indicators or terms of service. Contact information is provided via a physical address and a contact form with captcha protection, but no verified company emails or phone numbers are listed. Overall, the site is functional and informative but requires significant improvements in security and compliance to enhance trust and protect user data.

V

Vayamed GmbH

avaay.de

40

avaay.de represents a premium medical cannabis provider operating under Vayamed GmbH, part of the Sanity Group. The company focuses on delivering high-quality, natural cannabis products for patients and medical professionals, emphasizing pharmaceutical standards and sustainable cultivation. The website is well-structured, professionally designed, and optimized for SEO and mobile use, reflecting a mature digital presence. Technically, the site leverages WordPress with WooCommerce and Oxygen Builder, supported by Cloudflare CDN and multiple marketing and analytics tools with consent management, indicating a modern and compliant infrastructure. Security posture is solid with HTTPS, valid SPF and DMARC records, and security headers, though improvements in HSTS and DNSSEC could enhance protection. Overall, avaay.de demonstrates a high level of business credibility, privacy compliance, and technical sophistication, positioning it well in the healthcare e-commerce market.

V

Vayamed GmbH

vayamed.com

56

Vayamed GmbH operates as a specialized healthcare provider focusing on medical cannabis therapies, offering high-quality, natural cannabinoid products and expert consultation services primarily to patients, doctors, and pharmacists in Germany. The company is part of the larger Sanity Group, positioning itself as a reputable player in the medical cannabis market with a medium-sized business footprint. Their digital presence is built on WordPress with WooCommerce, integrating modern marketing and consent management tools. However, the website lacks a valid SSL certificate, which critically impacts its security posture. While security headers are partially implemented, the absence of HTTPS and modern TLS protocols exposes the site to significant risks. Privacy compliance is well addressed with clear cookie consent mechanisms and a comprehensive privacy policy. Contact information is prominently displayed, enhancing business credibility. Overall, the site demonstrates good content quality and SEO practices but requires urgent security improvements to protect user data and maintain trust.

V

vaay

vaay.com

69

vaay is a German-based e-commerce company specializing in high-quality CBD and hemp-derived products. The company operates under Sanity Care GmbH and maintains a strong market position by focusing on product quality, transparency, and customer education. Their product range includes CBD oils, vape pens, sleep sprays, active gels, massage oils, and bath bombs, targeting wellness and lifestyle consumers. The website is professionally designed, mobile-optimized, and provides clear navigation and comprehensive content in German with some English options. Technically, vaay leverages Shopify as its platform, enhanced with various marketing, analytics, and customer support tools such as Klaviyo, Usercentrics, Reamaze, and Littledata. Security measures include valid SSL, strong security headers, and secure cookie practices, although HSTS could be further strengthened. Privacy compliance is robust with clear policies and consent mechanisms. Overall, vaay demonstrates a mature digital presence with good security posture and privacy awareness, making it a trustworthy and professional online retailer in the CBD sector.

T

THE LÄB - How to LÄND and EXPÄND in Germany

the-laeb.de

40

THE LÄB is a technology-focused startup accelerator based in Karlsruhe, Germany, serving as the international orientation of the CyberLab Startup Accelerator. It supports startups primarily in the IT sector with mentoring, networking, and market entry assistance, targeting international entrepreneurs aiming to establish and expand in Germany, especially in the Baden-Württemberg region. The website is built on Squarespace and hosted by Squarespace, featuring a professional design and good content quality. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security shortfall. Security headers are partially implemented, but modern TLS protocols and advanced security features are missing. Privacy compliance is addressed with a privacy policy and cookie consent banner, though terms of service and security policies are absent. Contact information is clearly provided, including email, phone, physical address, and an embedded contact form. The site links to multiple partner and supporting organizations, reinforcing its credibility and network strength.

C

CyberForum Akademie

scaleup-leadership.de

40

The website scaleup-leadership.de represents the Scale-up Leadership program, a coaching and leadership development initiative targeted at startups transitioning to scale-ups, primarily in the technology sector in Germany. The program is organized by the CyberForum Akademie and funded by the L-Bank, positioning itself as a key player in European high-tech entrepreneurial networks. The site provides detailed program information, testimonials, and contact options including an external Microsoft Forms application form. Technically, the site is built on Squarespace CMS with standard fonts and assets, but critically lacks HTTPS support, exposing users to security risks. Privacy compliance is addressed with a cookie banner and a privacy policy in German, but no terms of service or explicit security policies are found. Overall, the site offers good content quality and user experience but suffers from a poor security posture due to missing SSL and security headers.

B

Bertelsmann

createyourowncareer.com

40

CreateYourOwnCareer.com is a career portal operated under the Bertelsmann group, a large multinational media and services conglomerate founded in 1835. The website provides comprehensive career-related content including job listings, graduate programs, internships, and networking events targeting students, graduates, and professionals. The site is built on TYPO3 CMS and hosted via Arvato Systems, reflecting a mature technical infrastructure with modern content management but lacking in SSL/TLS security. While the site includes cookie consent mechanisms and uses Google Analytics and Tag Manager for tracking, it lacks a valid HTTPS configuration, which is a critical security deficiency. The site demonstrates good content quality, branding consistency, and professional design, but the absence of HTTPS and related security best practices significantly lowers its security posture and overall trustworthiness.

U

UnternehmerTUM GmbH

unternehmertum.com

51

UnternehmerTUM GmbH is Europe's largest center for innovation and entrepreneurship, based in Germany, founded in 2002. It supports startups, founders, and companies by providing acceleration, incubation, corporate venturing, and networking services. The website is rich in content, professionally designed, and targets startups, researchers, and innovative companies. Technically, the site uses modern JavaScript frameworks, consent management tools, and analytics but suffers from a critical lack of HTTPS due to an invalid or missing SSL certificate, which severely impacts its security posture. Privacy compliance is strong with a comprehensive privacy policy and cookie consent mechanism. Business credibility is high with clear contact information, social media presence, and structured data. Overall, the site is professional and trustworthy but urgently needs to fix its SSL/TLS configuration to improve security and user trust.

M

mobilityportal gmbh

mobilityportal.de

40

mobilityportal gmbh operates a digital multimodal mobility platform focused on public transportation (ÖPNV) in Germany. The company offers integrated solutions for managing various transport modes including bus, tram, on-demand services, and e-scooters, enabling seamless door-to-door transport options. Their platform supports both front-end passenger services and back-office digital processes, targeting public transport operators, municipalities, and mobility providers. The website reflects a professional business presence with clear service descriptions and contact options, positioning the company as an innovative player in the transportation technology sector.

S

SECUDOS GmbH

secudos.de

40

SECUDOS GmbH is a German-based technology company specializing in innovative IT security solutions aimed at ensuring digital sovereignty and high-performance network infrastructures for businesses. Their product portfolio includes secure data exchange software (Qiata), a hardened operating system (DOMOS), and recovery technology for hardware appliances (SDR). The company positions itself as a reliable and experienced partner with over 20 years of expertise in complex network environments, serving a broad range of corporate clients. Technically, the website is built on Joomla CMS with modern frameworks like Bootstrap and jQuery, offering good mobile optimization and user experience. However, the absence of a valid SSL certificate and lack of HTTPS support significantly weaken the security posture, despite proper email authentication records and GDPR compliance. Overall, the site demonstrates good business credibility and privacy practices but requires urgent improvements in SSL/TLS implementation to enhance security and trust.

G

GAIA-X 4 KI

gaia-x4ki.eu

40

GAIA-X 4 KI is a medium-sized German research project focused on developing a data and service ecosystem for training and validating AI applications, particularly in the automotive and manufacturing sectors. The project emphasizes data sovereignty, transparency, and interoperability based on the GAIA-X infrastructure. The website provides detailed information about the project, consortium partners, news, and publications, targeting industry stakeholders, research institutions, and SMEs. Technically, the site uses modern TLS protocols, Bootstrap frontend, and likely a Ruby on Rails backend, hosted on Hetzner infrastructure. While HTTPS is properly implemented, the site lacks advanced security headers, DNS security features, and privacy/cookie policies, which lowers its security and privacy posture. Overall, the site is well-branded, professionally designed, and content-rich but could improve in privacy compliance and security hardening.

N

net-maxX GmbH

net-maxx.de

40

net-maxX GmbH operates a virtual platform designed for fan communities, leveraging interactive virtual worlds to connect users. The company is a small technology startup based in Germany, founded in 2023, and collaborates with partners such as Telemaxx and agenturserver.de. The website is built on the Ghost CMS platform and demonstrates good content quality and user experience with moderate performance. Security posture is adequate with HTTPS and SPF configured, but lacks advanced TLS features and email security enhancements like DMARC. Privacy compliance is basic, with a privacy policy present but no cookie consent mechanism detected. Overall, the site is professional and trustworthy but could improve in security and privacy areas.

J

Junior-Uni Ruhr

junioruni.ruhr

56

Junior-Uni Ruhr is a non-profit, privately funded educational and research institution based in Mülheim, Germany, serving children and youth aged 4 to 17. It offers practical, curiosity-driven courses without grades or pressure, focusing on STEM and sustainable development. The institution is recognized as a zdi-Schülerlabor and holds status as a provider of free youth welfare. The website is built on WordPress with Elementor and Bootstrap, hosted by Hetzner. While content quality and business credibility are good, the site lacks a valid SSL certificate and modern security configurations, which significantly impacts its security posture. Privacy policies and terms of service are present, but cookie consent mechanisms are missing. Social media presence is active, and contact information is clearly provided.

V

Verivox GmbH

verivox.de

40

Verivox GmbH operates a leading independent comparison portal in Germany, offering consumers the ability to compare tariffs across energy, telecommunications, insurance, and finance sectors. Established in 1998, the company has positioned itself as a market leader with multiple awards and a strong reputation for transparency and customer satisfaction. The website provides comprehensive services including tariff comparisons, calculators, and personalized recommendations, supported by a modern technical infrastructure leveraging advanced JavaScript frameworks and third-party analytics and consent management tools. Despite its strong market presence and user-centric design, the site suffers from an invalid SSL certificate, which poses a significant security risk and undermines user trust. The company demonstrates good privacy compliance with clear policies and consent mechanisms, but should address critical security issues promptly to maintain its high credibility and protect user data.

Z

ZENIT GmbH

zenit.de

40

ZENIT GmbH is a regional innovation and technology center based in North Rhine-Westphalia, Germany, focused on transforming the Mittelstand (SMEs) through services in innovation, technology transfer, digitalization, funding, and internationalization. The company holds a strong market position as a key facilitator and network coordinator for SMEs and research institutions in NRW, leveraging partnerships with European and regional stakeholders. The website reflects a mature digital presence with comprehensive content, event management, and community testimonials. Technically, the site is built on WordPress with modern JavaScript libraries and SEO optimizations, but suffers from a critical lack of a valid SSL certificate and modern security configurations, exposing it to significant security risks. Privacy compliance is partially met with a detailed privacy policy but lacks cookie consent mechanisms. Overall, the site is professional and trustworthy but requires urgent security improvements to protect user data and maintain credibility.

L

Lekkerland SE

lekkerland.de

40

Lekkerland SE is a leading convenience wholesaler and logistics provider in Germany, serving approximately 40,000 retail points with a broad product assortment and tailored services. The company is part of the REWE Group, a major European retail conglomerate. The website reflects a mature digital presence with comprehensive business information, structured data, and multi-language support. However, the technical infrastructure shows critical security weaknesses, notably the absence of a valid SSL certificate and HTTPS support, which exposes users to risks and undermines trust. Privacy compliance is well managed with cookie consent via Usercentrics and a comprehensive privacy policy. The site uses modern marketing and analytics tools but suffers from slow load times and lacks advanced security headers. Strategic improvements in SSL deployment and security hardening are essential to elevate the security posture and user trust.

F

Firstlead GmbH

firstlead-server.de

40

Firstlead GmbH operates the website firstlead-server.de as a service platform in partnership with the affiliate network ADCELL. The site primarily serves as an informational landing page providing company contact details and links to the ADCELL affiliate network. The business model focuses on affiliate marketing services targeting advertisers and affiliates in Germany. The website content is minimal and presented in both German and English, reflecting a small-sized technology sector company with a basic online presence. Technically, the website uses Cloudflare for DNS hosting but lacks a valid SSL certificate, resulting in no HTTPS support. The site includes Google Analytics and Google Tag Manager scripts for tracking but does not implement cookie consent mechanisms or advanced SEO features. Performance is moderate with basic mobile optimization and accessibility. The meta robots tag is set to noindex, indicating the site is not intended for public search engine indexing. From a security perspective, the absence of a valid SSL certificate is a critical vulnerability, exposing users to potential data interception risks. No security headers or advanced security policies are implemented. Privacy compliance is partial, with a privacy policy and terms of service linked externally on the ADCELL domain but no cookie consent or explicit GDPR compliance indicators on the site itself. Overall, the website presents a low-risk profile due to its limited functionality and content but requires urgent improvements in SSL configuration and privacy compliance to enhance trustworthiness and security posture.

W

Weiterbildungsportal Saarland

weiterbildungsdatenbank-saar.de

40

Weiterbildungsportal Saarland is a regional educational information platform focused on providing comprehensive resources about continuing education for individuals, companies, and educational providers within the Saarland region of Germany. The platform is supported by governmental and institutional partners, offering detailed course databases, funding information, and thematic content tailored to various user groups. Technically, the website is built on TYPO3 CMS with Bootstrap for responsive design, ensuring good accessibility and user experience. Security-wise, the site employs HTTPS with modern TLS protocols and a valid SPF record, though it lacks some advanced HTTP security headers such as HSTS and DMARC, which are recommended for enhanced protection. The use of Matomo analytics reflects a moderate user tracking approach with privacy compliance in mind. Overall, the site demonstrates a solid balance of content quality, technical implementation, and security posture, positioning it as a trustworthy and professional resource in its domain.

H

Handwerkskammer des Saarlandes

hwk-saarland.de

40

Handwerkskammer des Saarlandes is a regional government institution dedicated to supporting the craft and trade sector in Saarland, Germany. The organization provides comprehensive services including vocational training, further education, business start-up consulting, and operational support to handcraft businesses and individuals. The website reflects a well-established entity with a strong regional presence and a focus on quality and accessibility. Technically, the site is built on WordPress with modern JavaScript frameworks like Vue.js, ensuring a responsive and user-friendly experience. Security measures such as HTTPS, HSTS, and SPF are properly implemented, though there is room for improvement in OCSP stapling and certificate transparency. Privacy compliance is robust with a clear privacy policy and cookie consent mechanism. Overall, the site demonstrates a mature digital infrastructure aligned with its public service mission.

I

IHK Saarland

ihksaarland.de

40

IHK Saarland operates as a regional chamber of commerce and industry serving the Saarland region in Germany. The organization provides a broad range of services including business consulting, education and training, legal and regulatory guidance, and digital services to support local enterprises, founders, and various business stakeholders. The website reflects a well-structured and professional digital presence with comprehensive content tailored to its target audience of businesses and professionals in the region. Technically, the site uses a traditional JavaScript and CSS stack with jQuery libraries and is hosted via epag.net DNS infrastructure. While the site supports modern TLS protocols ensuring secure HTTPS connections, it lacks advanced security headers and DNS security features, indicating room for improvement in its security posture. Privacy compliance is well addressed with clear cookie consent mechanisms and accessible privacy policies. The website is not blocked by any WAF or security challenge, allowing full content access. Overall, the site scores well in business credibility and privacy compliance but could enhance technical and security aspects to improve performance and resilience.