Finance security reports

V

Visma e-conomic A/S

e-conomic.dk

37

Visma e-conomic A/S operates e-conomic.dk, a leading Danish online accounting software platform serving over 240,000 businesses. The company offers flexible subscription packages tailored to various business sizes and integrates with multiple business systems. The website is professionally designed with comprehensive content, clear navigation, and strong branding consistency. Technically, it uses Drupal 11 CMS, Cloudflare CDN, and modern JavaScript libraries, ensuring good performance and mobile optimization. However, a critical security gap exists as the main domain lacks HTTPS/SSL, exposing users to risks. Privacy and cookie policies are well implemented with GDPR compliance, and multiple contact channels including forms, email, and phone are available. The domain is mature and consistent with the business identity, owned by Visma Group. Overall, the site is trustworthy and business credible but urgently needs to enable HTTPS to improve security posture.

BMO Global Asset Management (BMO GAM) is a leading Canadian asset manager offering a broad range of investment products including mutual funds, ETFs, and alternative products. The website clearly targets investors, advisors, and institutional clients, reflecting a mature and well-established financial services business. The company operates under the larger Bank of Montreal (BMO) umbrella, reinforcing its market position and credibility. Technically, the website leverages modern web technologies such as Next.js and integrates with Adobe Launch and OneTrust for marketing and compliance. Hosting is provided via Akamai CDN, ensuring global content delivery. However, the absence of a valid SSL certificate and disabled TLS protocols represent significant technical and security shortcomings that undermine user trust and data protection. From a security perspective, while some security headers like HSTS and X-Frame-Options are present, the lack of HTTPS and modern TLS support is a critical vulnerability. No published security policies, incident response contacts, or vulnerability disclosure mechanisms were found, indicating gaps in security transparency and readiness. Overall, the website is professionally designed and content-rich, but the lack of proper SSL/TLS configuration and security disclosures lowers its security posture and trustworthiness. Strategic improvements in SSL deployment, security policy publication, and DNS security would significantly enhance the site's security and compliance standing.

HypoVereinsbank by UniCredit Bank GmbH operates a professional and comprehensive banking website targeting private and corporate customers in Germany. The site offers a wide range of financial services including online banking, investment products, loans, and wealth management. It is well-positioned in the market, recognized by industry awards such as 'Bank of The Year 2024' and 'Fairste Filialbank 2024'. The website demonstrates strong branding consistency and trust indicators, with clear contact information and GDPR compliance. Technically, the site uses modern JavaScript libraries and is hosted via Akamai with Adobe Experience Manager as the CMS platform. However, performance is currently slow and SSL/TLS configuration is invalid, which poses security risks. Security headers are mostly present but the Content-Security-Policy is overly permissive. No WAF or blocking mechanisms are detected, allowing full content access. Privacy and cookie policies are implemented with consent mechanisms. Overall, the site is professional and trustworthy but requires urgent SSL fixes to improve security posture.

I

INFINA

infina.at

30

INFINA is a leading independent credit brokerage firm in Austria specializing in residential construction financing. The company offers comprehensive credit comparison services from over 120 banks, personal consultation, and a wide range of financial tools to assist customers in securing optimal mortgage financing. Their extensive network of over 100 local partners ensures personalized service throughout Austria. The website reflects a mature and professional business with excellent content quality and user experience, targeting individuals and families seeking home financing solutions. Technically, the site is built on TYPO3 CMS with modern web technologies and includes interactive calculators and consent management tools. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts the site's security posture. Privacy compliance is well addressed with GDPR-aligned policies and cookie consent mechanisms. Overall, the business demonstrates strong credibility and market position but must urgently address its SSL/TLS configuration to improve security and trust.

A

ACI Worldwide

aciworldwide.com

40

ACI Worldwide is a mature, enterprise-level financial technology company specializing in global payments software and solutions. The company offers a broad portfolio of services including payments orchestration, fraud management, bill pay, and real-time payments, targeting banks, merchants, and billers worldwide. The website reflects a strong market position with extensive customer testimonials, partner logos, and a global reach across 95 countries. Technically, the site is built on WordPress hosted on WP Engine with Cloudflare CDN, leveraging modern marketing and analytics tools such as Google Tag Manager, Hotjar, and HubSpot. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts the security posture score. Security headers and content security policies are well implemented, but the lack of HTTPS is a major vulnerability. Privacy compliance is well addressed with a comprehensive privacy policy and cookie consent mechanism. Overall, the website is professional, content-rich, and trustworthy but requires urgent remediation of SSL/TLS issues to ensure secure user interactions.

Raiffeisenverband Salzburg eGen operates as a large regional banking cooperative in Austria, providing a comprehensive range of financial services including retail banking, corporate banking, investment products, insurance, and real estate services. The website targets private and corporate customers primarily in the Salzburg region, emphasizing local presence and digital innovation. The business is well-positioned as the largest banking group in Austria by branch count and employees, with a strong community and regional focus. Technically, the website is built on Adobe Experience Manager CMS with modern web technologies and responsive design, offering good user experience and accessibility. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which severely impacts the security posture. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Contact information and trust indicators are prominently presented, supporting business credibility. Overall, the site is professional and content-rich but urgently requires SSL implementation to secure user data and maintain trust.

Raiffeisen Zertifikate is a leading Austrian financial services provider specializing in certificate investment products, with a strong market position evidenced by multiple awards. The website is professionally designed, content-rich, and targets investors interested in sustainable and flexible investment options. Technically, the site uses TYPO3 CMS, integrates modern analytics and marketing tools, and is hosted behind Cloudflare. However, the security posture is weakened by the absence of a valid SSL certificate and disabled modern TLS protocols, which poses risks to data confidentiality and user trust. Privacy compliance is well addressed with comprehensive policies and cookie consent mechanisms. Overall, the site is trustworthy but requires urgent SSL/TLS remediation to improve security and user confidence.

Volkswagen Versicherungsdienst GmbH (VVD) is a medium-sized insurance service company operating as a subsidiary of Porsche Bank in Austria. It specializes in providing automotive insurance products and services to customers of Volkswagen Group brands and other vehicle owners. The website presents a professional and consistent brand image with comprehensive service offerings including liability, partial and full coverage insurance, legal protection, and additional guarantees. Technically, the site is built on Craft CMS and leverages Cloudflare for hosting and security, along with modern marketing and analytics tools such as Google Tag Manager and Facebook Pixel. However, a critical security gap exists due to the absence of a valid SSL certificate, resulting in no HTTPS support, which significantly undermines the security posture. Privacy compliance is well addressed with a detailed privacy policy and cookie consent mechanism. Contact information is clearly provided, enhancing business credibility.

FERNBACH Financial Software operates FlexFinance, a specialized software suite designed to optimize lending business processes including loan origination, credit lifecycle management, and risk management. The company targets banks and financial institutions, offering solutions that enhance efficiency, transparency, and compliance. With a user base exceeding 12,000 and over one million credit decisions processed annually, FERNBACH holds a solid position in the finance software niche, supported by multilingual capabilities and a consistent brand presence. Technically, the website employs modern front-end technologies such as jQuery, Bootstrap, and Popper.js, alongside analytics tools like Google Analytics and Microsoft Clarity. However, the site suffers from poor performance with a notably high load time and lacks a valid SSL certificate, which critically undermines its security posture. The absence of HTTPS and security headers exposes the site to potential risks, despite no detected vulnerabilities in SSL protocols themselves. Privacy compliance is well addressed with comprehensive privacy and cookie policies, including consent mechanisms aligned with GDPR requirements. Contact information is limited but present, primarily via a company email address. The overall website quality is good in terms of design, content relevance, and user experience, though technical and security improvements are necessary. Strategically, the company should prioritize securing its website with a valid SSL certificate and enabling HTTPS to protect user data and improve trust. Performance optimization and implementation of security headers would further enhance the site's security and user experience. Maintaining transparent privacy practices and expanding contact options could strengthen business credibility and customer confidence.

I

ING

ing.at

40

The website ing.at serves as an informational landing page announcing the transfer of ING Austria's private banking business to bank99 AG as of November 30, 2021. It provides contact information for former customers and legal representatives handling specific cases. The site is primarily targeted at former ING Austria private banking customers and does not offer active banking services. Technically, the site uses modern web technologies including Lit for UI components, service workers for offline capabilities, and integrates third-party services such as Usercentrics for cookie consent and Webtrekk for analytics. However, the SSL configuration is critically flawed with no valid certificate and no TLS protocols enabled, severely impacting security posture. Security headers are well implemented but undermined by the lack of proper SSL. The domain registration and DNS records are consistent with a legitimate banking entity, and the site includes standard privacy and cookie policies compliant with GDPR. Overall, the site is professional and trustworthy in content but requires urgent remediation of SSL issues to ensure secure user access.

A

Addiko Bank AG

addiko.com

40

Addiko Bank AG operates as a regional digital bank serving multiple European countries with a focus on online banking products such as savings accounts and loans. The website reflects a professional and consistent brand presence with clear navigation and relevant content targeting retail and corporate banking customers. Technically, the site is built on WordPress with modern plugins and integrates multiple analytics and marketing tools. However, the security posture is weakened by the absence of a valid SSL certificate and lack of modern TLS protocol support, which is critical for a financial institution. Privacy compliance is well addressed with GDPR-aligned policies and cookie consent mechanisms. Overall, while the business and technical aspects are solid, the security deficiencies pose a significant risk that must be remediated promptly.

G

GrECo

greco.services

40

GrECo is a well-established insurance and risk management specialist with a strong presence in Central and Eastern Europe, operating since 1925. The company offers a broad range of services including risk consulting, cyber insurance, health and benefits, and international insurance programs. The website reflects a mature digital presence with professional design, multilingual support, and structured data for SEO. However, the technical infrastructure shows critical security weaknesses, notably the absence of a valid SSL certificate and lack of HTTPS support, which undermines user trust and data security. Privacy policies are present and GDPR compliant, but cookie consent mechanisms are minimal. Overall, the site is content-rich and credible but requires urgent security improvements to align with best practices.

KPMG Austria GmbH operates a comprehensive and professionally designed website representing its global network of audit, tax, advisory, and legal services. The website targets clients and potential clients primarily in Austria and German-speaking regions, offering detailed insights into their services, industries, and career opportunities. The technical infrastructure leverages Adobe Experience Manager CMS, modern JavaScript frameworks like Vue.js and React, and integrates marketing and analytics tools such as Adobe Analytics, Demandbase, Gigya, and OneTrust for privacy compliance. Despite a strong content and business presence, the website suffers from critical security shortcomings, notably an invalid SSL certificate and lack of TLS protocol support, which significantly impacts its security posture. Privacy and cookie policies are well implemented with consent mechanisms, aligning with GDPR requirements. Overall, the site demonstrates high professionalism and trustworthiness but requires urgent remediation of its SSL/TLS configuration to ensure secure user interactions.

S

Software Daten Service Gesellschaft m.b.H.

sds.at

40

Software Daten Service Gesellschaft m.b.H. (SDS) is a medium-sized Austrian company specializing in software and services for the international financial industry, with additional focus on telecommunications and digital entertainment sectors. The company offers a comprehensive portfolio including securities processing, regulatory reporting, compliance, consulting, managed services, and professional testing. SDS benefits from a strong market position supported by its 50 years of history and affiliation with the Deutsche Telekom Group. The website reflects a professional and consistent brand image targeting financial institutions and related industries globally. Technically, the site is built on WordPress with modern plugins and SEO optimizations, but suffers from critical security shortcomings due to the absence of a valid SSL certificate and lack of HTTPS support. Security headers are present but insufficient to compensate for the missing encryption. Privacy and cookie policies are well implemented with consent mechanisms, supporting GDPR compliance. Contact information is clearly provided, enhancing business credibility. Overall, the site is content-rich and professionally maintained but urgently requires SSL/TLS remediation to improve security posture and trust.

G

GE Capital

gecapital.com

36

GE Capital operates as the financial services arm aligned with General Electric's industrial businesses, providing leasing, lending, retail credit, real estate financing, and mortgage services globally. The website reflects a professional and consistent brand presence with clear business descriptions and multiple regional contact points, targeting industrial customers seeking financial solutions. Technically, the site is built on Drupal 10 with Bootstrap and hosted behind Cloudflare, indicating a modern infrastructure. However, the absence of a valid SSL certificate and disabled TLS protocols represent significant security weaknesses that undermine secure communications. Privacy and cookie policies are well linked to official GE domains, showing good compliance posture, but no explicit security or incident response policies are found. Overall, the site is professional and credible but requires urgent security improvements to meet enterprise standards.

R

Raiffeisen Bausparkasse Gesellschaft m.b.H.

bausparen.at

24

Raiffeisen Bausparkasse Gesellschaft m.b.H. is a well-established Austrian financial services company specializing in building savings contracts and financing solutions for housing and related needs. The company has a strong market presence with over 60 years of experience and offers a range of products including classic building savings, financing for construction, renovation, education, and health care. The website reflects a professional and consistent brand image targeting private individuals seeking secure and reliable financial products. Technically, the site is built on Adobe Experience Manager and uses modern web technologies such as AngularJS and Adobe DTM for analytics and marketing. It is hosted behind Cloudflare, ensuring good performance and security at the network level. However, a critical security issue is the invalid or missing SSL certificate and lack of TLS protocol support, which severely impacts the security posture and user trust. Privacy compliance is well addressed with comprehensive privacy and cookie policies and a consent mechanism in place. Contact information is clearly provided, enhancing business credibility. Overall, the site is functional and professional but requires urgent remediation of SSL/TLS issues to ensure secure user interactions.

ERGO Versicherung Aktiengesellschaft operates the website das.at, providing legal protection insurance products under the D.A.S. Rechtsschutz brand in Austria. The company is a market leader with a strong reputation, offering services to private individuals, self-employed, and businesses. The website is professionally designed, content-rich, and targets Austrian customers with comprehensive insurance solutions and customer support channels. Technically, the site is built on TYPO3 CMS with modern web technologies and integrates multiple marketing and analytics tools. However, the absence of a valid SSL certificate and HTTPS support significantly weakens the security posture. Privacy and cookie policies are well implemented with consent mechanisms, supporting GDPR compliance. WHOIS data confirms the domain's legitimacy and alignment with the ERGO group. Overall, the website is credible and professional but requires urgent security improvements to protect user data and trust.

Zurich Insurance Group operates as a global insurance provider primarily in the finance sector, offering insurance and risk management services. The domain zurich.com is mature and strongly protected, reflecting the company's established market presence. However, the website content is currently inaccessible due to Incapsula WAF security mechanisms, and no valid SSL certificate is configured, resulting in no HTTPS support. This severely limits the ability to assess the website's content, privacy policies, and user engagement features. The technical infrastructure shows hosting via Incapsula, but lacks modern TLS protocols and security headers, indicating a need for significant security improvements. Overall, the website's security posture is weak due to missing SSL and blocked content, and privacy compliance cannot be verified. Strategic recommendations include implementing a valid SSL certificate, enabling modern TLS protocols, configuring security headers, and ensuring privacy and cookie policies are accessible to users.

O

Oberbank AG

oberbank.at

40

Oberbank AG is a well-established regional bank operating primarily in Austria and neighboring countries, offering a broad range of financial services including retail banking, corporate banking, savings, investments, financing, and online/mobile payment solutions. The website reflects a mature digital presence with comprehensive content tailored to private and corporate customers, supported by a modern technology stack based on Liferay and JavaServer Faces. The site demonstrates strong privacy compliance with detailed cookie consent mechanisms and GDPR-aligned privacy policies. However, the security posture is weakened by an invalid or missing SSL certificate and lack of TLS protocol support, which poses significant risks to secure communications. No explicit security or incident response policies are published, indicating room for improvement in transparency and readiness. Overall, the site is professional and trustworthy but requires urgent remediation of SSL issues to ensure secure user interactions.

C

Coface

coface.com

40

Coface is a global leader in trade credit insurance, debt collection, and business information services, supporting over 100,000 clients across approximately 200 countries. Founded in 1946 and headquartered in France, the company offers comprehensive solutions to help businesses manage credit risks and optimize credit management. The website reflects a mature digital presence with professional design, clear navigation, and extensive content tailored to its target audience of businesses seeking credit risk solutions. Technically, the site uses modern web technologies including a CDN (CloudFront), a CMS (Ibexa), and integrates advanced consent management and analytics tools. However, the security posture is weakened by an invalid SSL certificate and lack of enabled TLS protocols, which is a critical issue that must be addressed to ensure secure communications. Privacy compliance is strong, with clear privacy and cookie policies and consent mechanisms in place. Overall, Coface's website demonstrates high business credibility and professionalism but requires urgent SSL/TLS remediation to improve security and trust.

C

CRIF S.p.A.

crif.com

40

CRIF S.p.A. is a globally recognized enterprise specializing in credit bureau reporting, business information systems, analytics, and outsourcing services. The company operates in 37 countries with over 85 subsidiaries, serving both businesses and consumers with advanced digital solutions including open banking and ESG analytics. The website reflects a mature business with comprehensive service offerings and a strong market position in the finance sector. Technically, the website uses modern JavaScript libraries and frameworks such as jQuery, Bootstrap, and Swiper.js, and is hosted on a CDN network (Akamai), ensuring good performance and mobile optimization. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, severely impacting the security posture. Privacy and cookie policies are well implemented with consent mechanisms, supporting GDPR compliance. Overall, the website is professional and trustworthy but requires urgent remediation of its SSL/TLS configuration to protect user data and maintain trust.

R

Raiffeisen Bank International

rbinternational.com

40

Raiffeisen Bank International AG is a leading business bank headquartered in Austria, serving Austria and Central and Eastern Europe. The website presents comprehensive information about the bank's services, sustainability efforts, investor relations, and career opportunities, targeting investors, corporate clients, institutions, and private customers. The technical infrastructure leverages modern web technologies including Vue.js, Adobe Experience Manager CMS, and Cloudflare hosting, with integrations for analytics and marketing such as Mouseflow, Leadfeeder, and Google Tag Manager. Security headers are well implemented; however, the absence of a valid SSL certificate and disabled TLS protocols represent critical vulnerabilities that undermine the site's security posture. Privacy and cookie policies are present with consent mechanisms, indicating good compliance with GDPR. Overall, the website is professional and trustworthy but requires urgent remediation of SSL/TLS issues to ensure secure user interactions.

E

Erste Digital GmbH

erstegroupit.com

39

Erste Digital GmbH operates as the digital and IT service arm of Erste Group, the largest banking group in Central and Eastern Europe. The company focuses on delivering IT solutions and digital transformation services to support banking operations across the region. The website reflects a professional and consistent brand image aligned with Erste Group, targeting banking customers, IT professionals, and potential employees. Technically, the site uses modern frameworks and CDNs but suffers from a critical lack of SSL/TLS configuration, which severely impacts its security posture. Privacy and cookie policies are well implemented, indicating GDPR compliance. Overall, the site is functional and professional but requires urgent security improvements to protect user data and maintain trust.

A

Allianz Elementar Versicherungs AG

allianz.at

40

Allianz Elementar Versicherungs AG operates a comprehensive insurance website targeting private customers in Austria, offering a wide range of insurance and financial products including vehicle, health, accident, and life insurance. The website demonstrates strong market positioning with extensive content, professional design, and consistent branding. Technically, the site is built on Adobe Experience Manager, leveraging Cloudflare for hosting and CDN services, and integrates modern marketing and analytics tools such as Adobe Analytics and OneTrust for GDPR compliance. However, a critical security issue is the absence of a valid SSL certificate and HTTPS support, significantly impacting the security posture. Privacy policies and cookie consent mechanisms are well implemented, reflecting good GDPR compliance. Overall, the site is trustworthy and professional but requires urgent remediation of SSL/TLS issues to ensure secure user interactions.

E

Erste Asset Management

erste-am.com

40

Erste Asset Management operates as an international asset management company serving both institutional and private investors, primarily based in Austria. The website presents a professional and well-structured digital presence targeting these investor groups with clear navigation and relevant content. Technically, the site leverages a modular GEM framework hosted on AWS CloudFront CDN, ensuring scalability and modern web practices. However, the absence of a valid SSL certificate and HTTPS support significantly undermines the security posture, despite the presence of several security headers and a strict DMARC policy. Privacy compliance is well addressed with clear privacy and cookie policies, and GDPR adherence is evident. Overall, while the business credibility and content quality are strong, the critical lack of HTTPS is a major risk that needs immediate remediation.

V

Venionaire Capital

venionaire.com

28

Venionaire Capital is a medium-sized, globally active investment and advisory firm specializing in Private Equity and Venture Capital. The company offers a broad range of services including fund management, corporate finance, M&A, restructuring, and research products. It targets investors, entrepreneurs, and corporates, positioning itself as an entrepreneurial partner with a strong global footprint and multiple co-founded initiatives enhancing the investment ecosystem. The website content is professionally presented with clear navigation and rich service descriptions, reflecting a mature business model and market presence. Technically, the website is built on WordPress using the Enfold theme and integrates common technologies such as jQuery, Yoast SEO, and Google Analytics. However, the site suffers from critical security shortcomings, notably the absence of HTTPS and a valid SSL certificate, which severely impacts its security posture. Performance is slow, and while mobile optimization and SEO are good, accessibility is basic. Cookie consent mechanisms are present, but no explicit security or incident response policies are published. Security-wise, the lack of HTTPS and modern TLS protocols is a major vulnerability, exposing users to data interception risks. No advanced security headers or certificate transparency measures are implemented. The WHOIS data is consistent with the business claims, showing no suspicious patterns. Overall, the site demonstrates good business credibility but requires urgent security improvements to protect user data and enhance trust. Strategically, Venionaire Capital should prioritize obtaining and configuring a valid SSL certificate, enabling HTTPS, and implementing modern security headers and protocols. Enhancing privacy and incident response disclosures would also improve compliance and user confidence. These steps will strengthen the company's digital maturity and reduce risk exposure.

I

Inbank

inbank.eu

40

Inbank operates as an embedded financing platform focused on accelerating sales for merchants and providing tailored financing solutions to consumers across multiple European markets. The company supports a broad range of sectors including retail, eco-friendly products, and automotive financing, positioning itself as a significant player with over 872,000 active contracts and partnerships with more than 6,000 retailers. The website reflects a professional and consistent brand image with clear business information and a user-friendly design. Technically, the website is built on modern frameworks such as Nuxt.js and Vue.js, styled with Tailwind CSS, and hosted on Amazon AWS infrastructure. While the site performs moderately well and is mobile optimized, it lacks a valid SSL certificate and HTTPS support, which is a critical security flaw. Additionally, no security headers or advanced TLS configurations are present, exposing the site to potential risks. From a security perspective, the absence of HTTPS and security headers significantly lowers the security posture score. Privacy and cookie policies are implemented with consent mechanisms, indicating basic GDPR compliance. Contact information is clearly available, but no explicit security or incident response policies are found. The WHOIS data is consistent with the business claims, supporting domain legitimacy. Overall, the website demonstrates good business credibility and content quality but suffers from critical security shortcomings. Immediate remediation of SSL/TLS issues and implementation of security best practices are recommended to enhance trust and protect users.

E

E-COMMERCE BROKER SIA

finlat.lv

40

Finlat.lv is a Latvian-based credit comparison and brokerage platform operated by E-COMMERCE BROKER SIA, founded in 2021. The platform offers a wide range of financial services including consumer loans, mortgage-backed loans, auto loans, business loans, refinancing, and credit consolidation. It serves individuals and businesses in Latvia, providing a convenient one-application process to access multiple lenders. The website is well-structured with clear navigation, client testimonials, and partner logos enhancing its credibility. Technically, it is built on WordPress with Elementor and uses modern web technologies, but lacks a valid SSL certificate, which is a critical security concern. The absence of a cookie consent mechanism also poses potential GDPR compliance issues. The platform integrates several analytics and marketing tools such as Google Analytics, Yandex Metrica, and Facebook Pixel, indicating moderate user tracking. Overall, the business appears legitimate with consistent WHOIS data and transparent contact information, but needs to address security and privacy compliance gaps to improve trust and security posture.

B

Banqsoft AS

banqsoft.com

63

Banqsoft AS is a medium-sized Norwegian company specializing in financial software solutions for the Nordic market, focusing on asset finance, digital banking, and credit management. The company offers comprehensive software suites and add-on services designed to digitize and optimize financial operations for its clients. Banqsoft holds recognized certifications such as ISO 14001 and ISO 27001, underscoring its commitment to sustainability and information security. The website reflects a professional and consistent brand presence with good content quality and user experience.

E

Edlund A/S

edlund.dk

40

Edlund A/S is a Danish company specializing in flexible software solutions and consulting services for the life and pension insurance sector. Established in 1998, the company offers modular standard software and expert consulting to help clients modernize and optimize their insurance administration systems. The website reflects a professional and consistent brand presence targeting Danish life and pension companies. Technically, the site uses ASP.NET with Umbraco CMS, modern JavaScript modules, and is hosted behind Cloudflare. However, a critical security gap exists due to the absence of a valid SSL certificate, resulting in no HTTPS support, which significantly undermines the site's security posture. Privacy and cookie policies are present with consent mechanisms, and contact information is comprehensive. Analytics and marketing tools are actively used, indicating a moderate level of user tracking. Overall, the site is content-rich and professionally designed but requires urgent security improvements to protect user data and enhance trust.

C

ConvesioPay Dashboard

convesiopay.com

63

ConvesioPay is a relatively new payment service platform, established in 2023, providing a user dashboard for payment management. The website serves primarily as a login portal, indicating a business model focused on payment processing or financial services. The domain is registered with Cloudflare, Inc. and protected against unauthorized transfer, reflecting a legitimate and consistent registration profile. Technically, the site uses modern JavaScript modules, Google Fonts, and Google Tag Manager for analytics, but suffers from slow load times and lacks advanced SEO and accessibility features. Security posture is basic with HTTPS enabled and SPF records configured, but lacks important security headers, HSTS, and DMARC records. Privacy compliance is minimal with no visible privacy or cookie policies, and no GDPR indicators. Overall, the site is functional but requires significant improvements in security, privacy, and performance to enhance trust and compliance.

S

Slipcase

slipcase.com

51

Slipcase is a specialized content platform serving the global (re)insurance industry by aggregating and curating relevant news, insights, and thought leadership. The platform targets industry professionals and organizations, offering personalized dashboards, mobile app access, and organizational content distribution with reporting. The business is UK-based, established in 2000, and operates a niche service model focused on finance and insurance sectors. Technically, the website employs modern JavaScript modules, external libraries like Animate.css, and integrates marketing and analytics tools such as HubSpot and LinkedIn. Hosting is on Amazon AWS infrastructure. However, the website suffers from slow load times and lacks a valid SSL certificate, which significantly impacts security and user trust. From a security perspective, the absence of HTTPS, security headers, and domain protection measures exposes the site to risks and undermines compliance with modern security standards. Privacy compliance is basic, with policies present but lacking explicit consent mechanisms. Contact information is available, but no phone numbers are provided. Overall, Slipcase presents a professional and content-rich platform with good business credibility but requires urgent improvements in security posture and technical performance to enhance trust and compliance.

A

Aviva plc

aviva.com

40

Aviva plc is a leading diversified insurer headquartered in the United Kingdom, offering a broad range of insurance, wealth management, and retirement services primarily across the UK, Ireland, and Canada. The company targets investors, shareholders, career seekers, and socially conscious individuals, positioning itself as a trusted financial services provider with a strong market presence and extensive subsidiary network. The website reflects a professional and comprehensive corporate portal with rich investor relations content, leadership profiles, and sustainability initiatives. Technically, the website leverages modern JavaScript frameworks, Adobe Experience Manager CMS, and Akamai CDN for content delivery. It integrates advanced analytics and marketing tools such as Adobe Helix RUM and OneTrust for privacy compliance. The site is mobile-optimized, accessible, and SEO-friendly, providing a high-quality user experience. From a security perspective, while several best practices are implemented including CSP, X-Content-Type-Options, and HSTS headers, the SSL certificate is invalid and no TLS protocols are enabled, representing a critical vulnerability that undermines secure communications. No WAF or blocking mechanisms are detected, and privacy policies are comprehensive and GDPR compliant. The domain registration data aligns well with the business claims, indicating high legitimacy. Overall, the website is professional and credible but requires urgent remediation of SSL and TLS issues to ensure secure user interactions and maintain trust.

S

State Employees' Credit Union

ncsecu.org

40

State Employees' Credit Union (SECU) is a large, well-established financial cooperative serving over 2.8 million members primarily in North Carolina. The website presents a comprehensive suite of financial products including savings, loans, credit cards, mortgages, and insurance, supported by a professional and consistent brand presence. The site is built on Adobe Experience Manager and integrates Adobe marketing and analytics technologies, reflecting a mature digital infrastructure. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which is a significant risk for a financial institution handling sensitive member data. While security headers and privacy policies are present, the lack of cookie consent mechanisms and incident response information indicates room for improvement in privacy compliance and security transparency. Overall, the website is trustworthy and credible but requires urgent remediation of its SSL/TLS configuration to meet industry security standards.

T

TAS group

tasgroup.eu

40

TAS group is a leading Italian ICT company specializing in digital payment software and services for banks, fintechs, and corporates. The company offers a comprehensive Global Payment Platform and a suite of solutions covering digital payments, capital markets, real-time liquidity, financial networks, and PSD2 compliance. TAS is recognized in the IDC FinTech Top 100 and holds certifications such as UNI/PdR 125:2022, reflecting its commitment to social responsibility and workplace equality. The website targets financial institutions and technology providers, positioning TAS as a trusted partner in the evolving payments ecosystem. Technically, the website is built on WordPress with modern plugins and technologies including Kadence Blocks, HubSpot forms, and advanced analytics tools like Matomo and Plausible. The site is well-optimized for mobile and accessibility, with strong SEO practices and structured data markup enhancing discoverability and user experience. However, performance metrics indicate slow loading times, suggesting room for optimization. From a security perspective, the site implements several important HTTP security headers but lacks a valid SSL certificate and does not support TLS protocols, severely impacting its security posture. The absence of HTTPS and related best practices exposes the site to risks and undermines user trust. Privacy compliance is well addressed with clear privacy and cookie policies, consent mechanisms, and GDPR adherence. Overall, TAS group presents a professional and credible online presence with strong business and technical foundations. The primary risk lies in the lack of proper SSL/TLS configuration, which should be urgently addressed to secure communications and maintain trust. Strategic recommendations include implementing HTTPS, enabling modern TLS protocols, and enhancing security configurations to align with industry best practices.

B

Blackstone

blackstone.com

40

Blackstone is a leading global alternative asset manager with a strong market position and diversified investment offerings including private equity, real estate, credit, and energy sectors. The website reflects a mature digital presence with comprehensive business information, professional design, and clear navigation targeting institutional and individual investors as well as financial advisors. The technical infrastructure leverages WordPress VIP, Cloudflare CDN, and modern analytics tools such as New Relic and Google Tag Manager, indicating a robust digital maturity. However, the security posture is weakened by an invalid SSL certificate and lack of modern TLS protocol support, which poses risks to user trust and data security. Privacy compliance is generally good with a clear privacy policy and GDPR considerations, but the absence of a cookie consent mechanism is a gap. Overall, the site is credible and professional but requires urgent remediation of SSL issues to enhance security and trust.

C

Cryptex

cryptex.com

58

Cryptex is a cryptocurrency exchange platform offering secure and user-friendly services for buying, selling, and exchanging popular cryptocurrencies such as Bitcoin, Ethereum, and Ripple. The platform targets both beginners and professional traders, providing an intuitive interface and immediate account funding options. The website demonstrates a consistent branding approach and basic content quality, though it lacks comprehensive privacy and cookie policies. Technically, the site is built on modern technologies like React and uses Google Analytics for tracking, but suffers from slow load times and lacks a valid SSL certificate, which is a critical security concern. The absence of essential security headers and incomplete privacy compliance further impact its security posture. Overall, while the business model and market positioning are clear, the platform requires significant improvements in security and privacy to enhance trust and compliance.

The website exmo.com is currently inaccessible due to a Cloudflare Turnstile human verification challenge page that blocks direct content access. This prevents a full analysis of the website's business offerings and user-facing content. The domain is mature, registered since 2002, and uses Cloudflare for DNS and security services. However, the SSL certificate is invalid or missing, resulting in no HTTPS availability at the time of analysis. No privacy, cookie, or terms of service policies are visible, nor is any contact information or business details exposed on the challenge page. Performance is poor with a very slow load time and no actual page content beyond the security challenge.

О

ООО «Айкюсофт»

guarantee.money

65

The website guarantee.money operates as an escrow service platform primarily targeting Russian-speaking users. It facilitates secure transactions between buyers and sellers by acting as a trusted third party holding funds in escrow until transaction conditions are met. The business is positioned as a medium-sized technology and finance service founded in 2017, with a focus on online marketplaces, arbitration, and payment link generation. The company behind the service is ООО «Айкюсофт», based in Russia. Technically, the site is built on a modern React and Next.js stack with Material-UI for UI components, indicating a contemporary digital infrastructure. However, the site suffers from a critical security shortcoming: the absence of a valid SSL certificate and proper HTTPS support, which undermines user trust and data security. While HSTS headers are configured, they are ineffective without valid SSL. Privacy and terms of service pages exist but cookie consent mechanisms are missing, indicating partial privacy compliance. Contact information is limited to an email address at iqsoft.company, with no phone or physical address provided. Overall, the site is functional and content-rich but requires urgent security improvements to meet industry standards and user expectations.

L

Luminor

luminorcareers.ee

37

LuminorCareers.ee is a professional career portal for Luminor bank, primarily targeting job seekers in Estonia and the Baltic region. The website offers detailed job listings, employee testimonials, and career-related information, positioning Luminor as an employer of choice in the banking sector. The site leverages modern web technologies and a CMS platform to deliver content but suffers from significant security shortcomings, notably the absence of a valid SSL certificate and HTTPS support. Privacy compliance is well addressed through OneTrust cookie consent and a comprehensive privacy policy. However, the lack of visible contact information and security policies limits transparency. Overall, the site is functional but requires urgent security improvements to protect user data and enhance trust.

B

Banqup Group

banqup.com

65

Banqup Group operates a sophisticated digital platform focused on streamlining invoicing, payments, and compliance for a wide range of business customers including professionals, accountants, SMEs, and large enterprises. The company holds a strong market position in Europe, supported by its parent company Unifiedpost Group, and offers key services such as e-invoicing, compliance management, and integration with existing business software. The platform is designed to reduce administrative overhead and accelerate financial workflows. Technically, the website leverages modern web technologies including React and Next.js, with content managed via Storyblok CMS and hosted through a combination of Webflow and cloud services. While the site is content-rich and well-structured with good SEO and accessibility practices, performance is somewhat slow, and the SSL/TLS configuration is currently invalid, which poses a significant security risk. Security posture is moderate; the site employs HSTS and DMARC policies but lacks a valid SSL certificate and modern TLS support, which are critical for secure communications. Privacy compliance is strong, with a comprehensive privacy policy and cookie consent mechanism in place. Business credibility is high, supported by clear contact information, leadership announcements, and investor relations presence. Overall, Banqup presents a professional and trustworthy digital presence with room for improvement in security infrastructure. Addressing SSL/TLS issues and enhancing security headers would significantly improve the security posture and user trust.

Ს

სს “საკრედიტო საინფორმაციო ბიურო კრედიტინფო საქართველო”

mycreditinfo.ge

61

Mycreditinfo.ge is a Georgian finance sector website operated by სს “საკრედიტო საინფორმაციო ბიურო კრედიტინფო საქართველო”, providing credit information services including free and premium credit reports, credit score monitoring, and educational content. The site targets individuals and legal entities in Georgia seeking to manage and improve their credit profiles. The business model includes both free access and paid premium services, positioning it as a key player in the local credit information market. Technically, the website is built on Angular 13 and integrates common analytics and marketing tools such as Google Analytics and Facebook Pixel. It is hosted on Microsoft Azure, indicating a modern cloud infrastructure. However, the site suffers from slow performance due to large page size and load times, which could impact user experience. From a security perspective, the site has significant weaknesses: it lacks a valid SSL certificate and does not support any TLS protocols, severely limiting secure communications. While HSTS is enabled, its benefits are negated by the missing SSL. The site implements SPF and DMARC for email security and has basic security headers, but lacks advanced features like OCSP stapling and session resumption. Privacy and cookie policies are present with a consent mechanism, but GDPR compliance is not clearly demonstrated. Overall, the site is functional and content-rich but requires urgent improvements in SSL/TLS configuration to ensure user data protection and trust. Performance optimization and enhanced privacy compliance would further strengthen its digital maturity and security posture.

A

AS CREDITINFO EESTI

e-krediidiinfo.ee

40

AS CREDITINFO EESTI operates the e-krediidiinfo.ee website, providing comprehensive credit and business information services primarily for Estonian, Lithuanian, and Finnish companies. The platform offers services such as credit risk assessments, monitoring, payment default management, and sanctions screening, targeting businesses seeking to evaluate their partners and clients. The website demonstrates a professional design with clear navigation and relevant content tailored to its target audience. However, the technical infrastructure shows room for improvement, particularly in security and performance aspects. The absence of a valid SSL certificate and HTTPS support is a critical vulnerability that undermines user trust and data security. The site employs modern web technologies and integrates multiple analytics and marketing tools with a compliant cookie consent mechanism, reflecting a moderate level of digital maturity.

L

Luminor Bank AS

luminor.ee

40

Luminor Bank AS operates as a leading financial institution in the Baltic region, offering a comprehensive suite of banking services including payments, loans, savings, investments, and private banking. The website targets both retail and business customers and positions itself as the third largest financial services provider in the Baltics. The digital presence is built on modern web technologies such as React and integrates tools like Google Tag Manager and LiveChat for enhanced user engagement. However, the website suffers from a critical security flaw due to the absence of a valid SSL certificate, exposing users to potential data interception risks. Privacy and cookie policies are well implemented and GDPR compliant, reflecting a strong commitment to user data protection. Overall, while the business credibility and content quality are high, the security posture requires urgent improvement to meet industry standards and protect customer data effectively.

U

Unifiedpost

rekini.lv

40

Rekini.lv operates as a Latvian digital invoicing and payment platform affiliated with Unifiedpost. It provides services for invoice receipt, payment, and invoice preparation via a partner platform Banqup. The website targets businesses and individuals in Latvia requiring invoicing solutions. Technically, the site uses a modern frontend stack including jQuery, Bootstrap, and multiple tracking and analytics services, but suffers from slow load times and lacks a valid SSL certificate, which critically impacts security. The security posture is weak due to missing HTTPS, absence of DMARC, DNSSEC, and domain protection locks. Privacy compliance is basic with a cookie consent modal and privacy policy present but no terms of service or incident response information. Overall, the site is functional but requires urgent security improvements to protect user data and enhance trust.

SEB Eesti operates as a major banking institution in Estonia, providing a broad spectrum of financial services including retail, corporate, and private banking. The website reflects a mature and professional digital presence with comprehensive content targeting private individuals and business clients. The technical infrastructure is based on Drupal CMS with modern frontend technologies, offering good mobile optimization and accessibility. However, the security posture is significantly weakened by the absence of a valid SSL certificate and lack of HTTPS support, which is a critical vulnerability for a financial services website. Privacy compliance is well addressed with clear cookie and privacy policies, and the domain registration is consistent and trustworthy. Strategic improvements in SSL/TLS configuration and security headers are urgently recommended to protect user data and maintain trust.

A

AS Kredītinformācijas Birojs

kib.lv

40

AS Kredītinformācijas Birojs is a Latvian credit information bureau providing credit data and reporting services to individuals and businesses. The company is positioned as a trusted entity in the Latvian financial sector, supported by ISO 27001 certification and memberships in recognized organizations such as Creditinfo and the Latvian Chamber of Commerce (LTRK). Their services focus on promoting responsible lending and credit transparency. Technically, the website is built on WordPress with common libraries like jQuery and uses Cookiebot for GDPR-compliant cookie consent. The site is moderately performant and mobile-optimized, though page load times could be improved. Security posture is adequate with HTTPS and SPF/DMARC email protections, but lacks advanced SSL features like HSTS and OCSP stapling. Privacy policies and terms of service are clearly presented and GDPR compliant. Overall, the website reflects a professional and credible business with room for technical and security enhancements.

C

Creditinfo

creditinfo.is

52

Creditinfo is a leading Icelandic company specializing in the provision of financial and business information services, including credit scoring, business data, and media monitoring. The company targets both individuals and businesses in Iceland, offering subscription-based and service-oriented products to support informed decision-making. The website reflects a mature and professional business with a clear market position and a comprehensive range of services. Technically, the site is built on Webflow and integrates modern marketing and analytics tools such as Google Tag Manager, Cookiebot, and Weglot for multilingual support. However, the website suffers from a critical security deficiency due to the absence of a valid SSL certificate and HTTPS support, exposing users to potential risks. Privacy and cookie policies are well-presented and GDPR compliant, with active consent mechanisms. Overall, while the business credibility and content quality are strong, the security posture requires urgent improvement to protect user data and maintain trust.

Ს

სს საკრედიტო საინფორმაციო ბიურო კრედიტინფო საქართველო

creditinfo.ge

47

Creditinfo Georgia is a mature credit information bureau operating since 2006, providing a range of credit-related services including credit reports, scoring, monitoring, and business risk databases. The company targets individuals and legal entities in Georgia, leveraging its affiliation with the international Creditinfo Group to maintain a strong market position. The website is built on WordPress and uses common plugins and scripts to deliver content and interactive forms. While the site is professionally designed with good content relevance and navigation, it lacks a valid SSL certificate, which severely impacts its security posture. Contact information is clearly presented, and privacy policy exists, but cookie policy and terms of service are missing. Overall, the site demonstrates moderate trustworthiness but requires urgent security improvements.

A

AS Creditinfo Eesti

creditinfo.ee

40

AS Creditinfo Eesti operates Estonia's largest and most trusted business information database, offering comprehensive credit information, payment default registers, credit ratings, and business lists. As part of the international Creditinfo Group, it serves a broad audience including businesses and individuals seeking to manage credit risks and make informed financial decisions. The company is well-established with a domain age of 9 years and recognized certifications such as ISO 27001, underscoring its commitment to information security. Technically, the website is built on WordPress with modern JavaScript libraries like jQuery and Slick Carousel, integrated with analytics and marketing tools including Google Tag Manager, Hotjar, and Facebook Pixel. The site demonstrates good SEO and mobile optimization, though performance is moderate and could benefit from further optimization. The hosting and DNS infrastructure is stable but lacks advanced security features like DNSSEC and domain protection locks. Security posture reveals critical issues, notably the absence of a valid SSL certificate, which severely impacts user trust and data protection. While DMARC policies and some best practices are in place, the lack of HTTPS and HSTS headers exposes the site to potential risks. Privacy compliance is strong, with clear cookie consent mechanisms and GDPR adherence. Business credibility is high, supported by clear contact information, social media presence, and trust signals. Overall, the site is functional and professional but requires urgent remediation of SSL/TLS issues to ensure secure communications and maintain trust. Strategic improvements in DNS security and domain management would further enhance its security posture.