Finance security reports

G

GBM Administradora de Activos S.A. de C.V. S.O.F.I.

gbmfondos.com.mx

63

GBMfondos is a well-established Mexican financial services company specializing in investment funds and personalized investment advisory through its GBMadvisor platform. With over 35 years of industry experience and recognition such as Morningstar Awards, it holds a strong market position in Mexico's finance sector. The company targets investors seeking accessible and intelligent investment solutions, supported by a mobile application and a comprehensive digital platform. Technically, the website is hosted on Amazon AWS and employs modern tracking and analytics tools including Google Analytics, Facebook Pixel, and Hotjar, indicating a mature digital marketing strategy. However, performance is slow and some SEO and accessibility aspects are basic. Security-wise, the site uses TLS 1.2 and 1.3 with a strict DMARC policy, but lacks advanced SSL features like HSTS and OCSP stapling, and does not have a published security policy or incident response contacts. Overall, the site is professional and trustworthy but could improve in security posture and privacy compliance.

G

GBM

gbm.com

57

GBM is a leading financial services company in Mexico offering a broad range of investment products, trading platforms, and advisory services targeting both individual and institutional investors. The company positions itself as a comprehensive investment ecosystem with strong market presence and a wide product portfolio including stocks, ETFs, bonds, and alternative investments. Their digital platform is supported by WordPress CMS with advanced SEO and marketing integrations, but suffers from slow performance and lacks a valid SSL certificate, which is a critical security concern. Marketing and analytics tools are extensively used, indicating a mature digital marketing strategy but raising privacy considerations. Legal and privacy documentation is comprehensive and available in Spanish, supporting regulatory compliance. However, explicit security policies and incident response information are not publicly disclosed.

D

DWS Group

dws.de

66

DWS Group is a leading global asset manager headquartered in Germany, offering a broad range of investment solutions including ESG, infrastructure, equity, bonds, and ETFs. The company has a strong market position with over 60 years of investment expertise and a large workforce. Their digital presence is built on modern web technologies such as Vue.js and integrates advanced video content delivery via Brightcove. The website demonstrates good SEO and user experience practices, with comprehensive privacy and cookie consent mechanisms in place. Security posture is solid with strict SPF and DMARC policies and use of TLS 1.3, though improvements such as enabling HSTS and OCSP stapling are recommended. Fraud warnings and clear contact information enhance user trust. Overall, the site reflects a mature digital infrastructure aligned with enterprise-grade asset management services.

B

BHW Bausparkasse AG

bhw.de

58

BHW Bausparkasse AG is a well-established German financial institution specializing in building savings and home financing products. The company operates a comprehensive website offering detailed information on its products, services, and customer support, targeting private customers interested in real estate financing and savings. The website is built on Adobe Experience Manager and integrates Webtrekk analytics for user tracking and marketing optimization. Security measures include a valid SSL certificate with TLS 1.2 and strong cipher suites, SPF and DMARC email authentication, and multiple domain verification records, although improvements such as enabling HSTS, OCSP stapling, and TLS 1.3 are recommended. The company maintains GDPR-compliant privacy and cookie policies with explicit consent mechanisms. Contact information is clearly provided with phone numbers and contact forms, but no explicit data protection officer contact or security policy page was found. Overall, the website demonstrates a mature digital presence with good usability and trust indicators, supported by strategic partnerships with Deutsche Bank and Postbank.

N

norisbank GmbH

norisbank.de

57

norisbank GmbH is a direct bank subsidiary of Deutsche Bank Gruppe, headquartered in Bonn, Germany. The company offers a range of financial products including credit, checking accounts (Girokonto), savings accounts (Tagesgeld), credit cards, and securities depot services. The website demonstrates a strong market position with multiple awards and certifications, targeting private customers, business clients, students, and youth. The business model focuses on digital banking services with an emphasis on online and mobile banking platforms. Technically, the website is built on Adobe Experience Manager with integrations for Adobe Analytics and Usercentrics for consent management, reflecting a mature digital infrastructure. However, the website currently lacks a valid SSL/TLS certificate, which is a critical security vulnerability. Email security is well configured with SPF and DMARC policies. Privacy and cookie policies are present and GDPR compliant, but no explicit security or incident response policies are found. Overall, the site is professional, trustworthy, and well-optimized for SEO and accessibility, but requires urgent improvements in SSL security to protect user data and maintain trust.

M

maxblue

maxblue.de

61

maxblue is the online brokerage platform of Deutsche Bank AG, offering a comprehensive suite of investment and trading services including securities trading, depot management, and savings plans. The website positions itself as a strong partner for both beginners and professional investors in Germany, providing extensive market data, analysis, and digital tools. Technically, the site is built on Adobe Experience Manager with Angular framework, leveraging modern web technologies and integrating Adobe Launch for marketing and analytics. Security measures include strong TLS 1.2 encryption, SPF and DMARC email policies, and absence of major SSL vulnerabilities, though improvements like enabling HSTS and TLS 1.3 could enhance security further. The site demonstrates good privacy compliance with clear policies and consent mechanisms. Overall, maxblue presents a professional, trustworthy, and well-structured online brokerage service with a solid digital infrastructure.

B

Berenberg

berenberg.com

65

Berenberg is a historic and well-established financial institution founded in 1590, headquartered in Hamburg, Germany, with a strong presence across Europe and the United States. The company offers a comprehensive suite of financial services including investment banking, corporate banking, asset management, and fund management. It is recognized as one of Europe's leading advisors with a large equity research team covering over 800 European companies. The website reflects a mature digital presence with detailed business information, multiple international office locations, and a focus on client service and sustainability. Technically, the website employs modern web technologies such as JavaScript frameworks, SVG graphics, lazy loading, and structured data for SEO. Hosting is on Microsoft Azure with DNS managed by Colt, and the SSL configuration is robust with TLS 1.2 and strong cipher suites. Cookie consent is managed via CookieFirst, ensuring compliance with privacy regulations. However, there is room for improvement in security headers and protocols, such as enabling HSTS, DNSSEC, and TLS 1.3. From a security perspective, the site demonstrates good practices including SPF and DMARC email protections, OCSP stapling, and no detected SSL vulnerabilities. The privacy policy and cookie consent mechanisms are comprehensive and GDPR compliant. No explicit incident response or vulnerability disclosure pages were found, which could be enhanced to improve transparency and security posture. Overall, Berenberg's website and digital infrastructure reflect a high level of professionalism and trustworthiness, supporting its position as a major player in the financial services sector. Strategic improvements in security protocols and transparency could further strengthen its risk management and client confidence.

H

HBL Solutions

hblsolutions.ch

61

HBL Solutions is a Swiss Banking-as-a-Service provider operating under the regulated banking license of Hypothekarbank Lenzburg AG. The company specializes in embedding banking products such as accounts, cards, payments, securities portfolios, and pension plans into the digital customer journeys of partner companies. Their market position is that of a Swiss pioneer in embedded and open finance, supported by a robust banking infrastructure and regulatory compliance. Technically, the website is built on Umbraco CMS with modern JavaScript libraries like Swiper.js and jQuery, and employs Cookiebot for GDPR-compliant cookie consent management. However, the absence of a valid SSL certificate is a critical security gap. The security posture shows strengths in regulatory compliance and consent management but weaknesses in transport security and DNS security features. Overall, the business is well-positioned in the Swiss finance sector with a clear focus on embedded finance, but should urgently address SSL and DNS security to improve trust and compliance.

F

Finstar AG

finstar.ch

69

Finstar AG is a Swiss-based company specializing in integrated IT solutions for private and universal banks as well as fintechs. With over 40 years of experience, the company offers customized and cost-effective banking software and services, positioning itself as a trusted partner in the financial technology sector. Their offerings include a broad range of products and services such as APIs, digital onboarding, and digital asset platforms, supported by a strong ecosystem of partner banks and financial institutions. The company is a subsidiary of Hypothekarbank Lenzburg AG and holds the prestigious 'swiss made software' label, underscoring its commitment to quality and reliability. Technically, the website is built on the Umbraco CMS and leverages modern JavaScript libraries including GSAP and ScrollMagic for enhanced user experience. It integrates Cookiebot for GDPR-compliant cookie consent management and Google Tag Manager for analytics and marketing. However, the website currently lacks a valid SSL certificate and does not support modern TLS protocols, which is a critical security gap. Performance is slow, likely due to the large page size and resource count, but mobile optimization and accessibility are rated good. From a security perspective, the domain has well-configured SPF and DMARC records with a strict reject policy, reducing email spoofing risks. Despite this, the absence of HTTPS and security headers significantly lowers the security posture. No explicit security policy, incident response contacts, or vulnerability disclosure mechanisms were found. The cookie consent mechanism is comprehensive and transparent, supporting GDPR compliance. Overall, Finstar AG presents a professional and trustworthy digital presence with strong business credentials and compliance in privacy and cookie management. The primary risk lies in the lack of HTTPS, which should be addressed urgently to protect user data and maintain trust. Strategic improvements in security infrastructure and transparency around security policies would enhance the company's risk profile and customer confidence.

H

Hypothekarbank Lenzburg AG

hblasset.ch

56

HBL Asset Management, a brand of Hypothekarbank Lenzburg AG, operates a professional asset management and investment product platform targeting private investors primarily in Switzerland. The website offers financial market news, investment insights, and profiling tools to support investor decision-making. Technically, the site is built on the Umbraco CMS and integrates several modern web technologies including Google Analytics, Cookiebot for GDPR-compliant cookie consent, and Google Tag Manager. However, the site lacks HTTPS encryption, which is a critical security deficiency. While cookie consent and privacy policies are well implemented, the absence of SSL/TLS and security headers exposes users to risks. The company maintains a strong digital presence with social media integration and clear contact information, but should urgently address security gaps to protect user data and enhance trust.

S

SCHUFA

schufa.de

48

SCHUFA is a major German credit bureau specializing in credit scoring and risk assessment services for consumers and businesses. The website is currently protected by a FriendlyCaptcha challenge, indicating active bot mitigation measures. However, the site lacks visible privacy, cookie, or terms of service policies on the captcha landing page, and no direct contact information is provided. The DNS configuration shows strong email authentication with SPF and DMARC policies, but the SSL/TLS configuration is critically lacking, with no valid certificate or secure protocols enabled. This presents a significant security risk for users and the business. The technical infrastructure relies on external captcha services and is hosted via United Domains nameservers. Performance is moderate but user experience and content quality are poor due to the captcha gate and lack of accessible content.

D

DKB AG

dkb-bank.de

56

DKB AG is a large German direct bank focused on sustainable banking services including checking accounts, loans, investments, and renewable energy financing. It holds a strong market position as one of the top 20 banks in Germany by balance sheet size and is recognized for its sustainability leadership with ISS ESG Prime-Status. The website is built on modern web technologies including Nuxt.js and Contentful CMS, offering excellent mobile optimization and user experience. However, the SSL configuration is currently misconfigured with a self-signed certificate and no supported TLS protocols, representing a significant security risk. Security headers are present but could be enhanced with better SSL/TLS setup and HSTS configuration. Overall, the bank demonstrates strong trust indicators and compliance with GDPR and cookie policies, supported by comprehensive privacy and terms of service documentation.

F

Finance Forward

financefwd.com

59

Finance Forward operates as a leading German-language online media platform specializing in new finance topics such as fintech, blockchain, and banking. The website offers a comprehensive range of services including news articles, podcasts, newsletters, and event information, targeting professionals and enthusiasts in the finance sector. The business model is centered on digital content delivery with monetization through advertising and partnerships. The company maintains a strong market position as a trusted source for fintech and finance news in Germany, supported by consistent branding and high-quality content.

P

PMHinvestments

pmhinvestments.com

52

PMH Investments is a Dutch investment company focused on small and medium-sized enterprises with strong growth potential (scale-ups). The company positions itself as an active investor providing not only capital but also strategic, financial, and coaching support to entrepreneurs. Their market niche is well-defined within the Dutch finance sector, targeting growing businesses. The website is built on WordPress with a solid SEO foundation and multilingual support, indicating a moderate level of digital maturity. However, the technical infrastructure shows weaknesses in security, notably the absence of a valid SSL certificate and lack of modern TLS protocols, which undermines user trust and data protection. Tracking and analytics are implemented via Google Tag Manager and WPMU DEV Analytics, but no cookie consent mechanism is present, which may raise compliance concerns. Overall, the security posture is basic with significant room for improvement, especially in SSL/TLS configuration and email security policies. Strategic recommendations include securing the website with a valid SSL certificate, implementing DMARC, and enhancing transparency around privacy and security policies.

N

Nomupay

nomupay.com

66

Nomupay is a payment solutions provider offering a comprehensive suite of services including global acquiring, online payments, payouts, and fraud prevention tools. Positioned as a global payment platform with local licenses and extensive payment method coverage, Nomupay targets businesses seeking seamless and scalable payment processing solutions. The website demonstrates a mature digital presence with WordPress CMS, Oxygen Builder, and multilingual support via TranslatePress. Integration of Google Analytics, Tag Manager, and LinkedIn Insight indicates moderate user tracking and marketing sophistication. However, the absence of a valid SSL certificate and lack of TLS support represent significant security vulnerabilities that undermine user trust and data protection. While privacy and cookie policies are present and GDPR compliant, the site lacks explicit security and incident response documentation. Overall, Nomupay presents a professional and trustworthy brand but requires urgent security improvements to safeguard its digital assets and customer data.

G

GBM

gbm.com.mx

57

GBM is a leading Mexican financial services company offering a broad range of investment products, trading platforms, and advisory services to both individual and institutional clients. The company positions itself as a comprehensive investment ecosystem with over 6,000 financial instruments and a strong advisory network. Their website reflects a mature digital presence with extensive content, multiple service tiers, and integrated marketing and analytics tools. However, the site suffers from critical security shortcomings, notably the lack of a valid SSL certificate and absence of modern TLS protocols, which undermines user trust and data security. While privacy and cookie policies are present, explicit security policies and incident response information are not found, indicating potential compliance gaps. Overall, GBM demonstrates strong market positioning and digital maturity but requires urgent security improvements to safeguard client data and maintain regulatory compliance.

M

Münchener Hypothekenbank eG

mhb.de

60

Münchener Hypothekenbank eG is a specialized financial institution focused on long-term real estate financing, serving private customers, commercial clients, and investors primarily in Germany. The bank emphasizes sustainability in its lending practices and maintains a strong market position with a history dating back to 1896. The website reflects a mature digital presence built on Drupal 10, integrating modern frontend technologies and a comprehensive cookie consent mechanism via Cookiebot. Analytics are handled through Matomo, balancing user tracking with privacy compliance. Security posture is solid with modern TLS protocols and no known vulnerabilities, though improvements such as DNSSEC, DMARC, and HSTS could enhance protection. Contact information is clearly presented, supporting customer engagement. Overall, the site demonstrates professionalism and trustworthiness aligned with its financial services business.

B

Berenberg

berenberg.de

65

Berenberg is a historic private bank and financial services provider founded in 1590 in Hamburg, Germany. It offers wealth management, asset management, corporate banking, and investment banking services to a diverse clientele including wealthy private clients, corporations, and institutional investors. The bank maintains a strong market position in Europe and the US with multiple offices and a broad service portfolio. Technically, the website employs modern web technologies with good performance and mobile optimization, supported by a robust SSL configuration and DNS setup. Security practices include SPF and DMARC email protections, OCSP stapling, and strong cipher suites, though improvements such as enabling HSTS and DNSSEC could enhance security further. Overall, Berenberg demonstrates a mature digital presence with strong trust indicators and compliance with GDPR and cookie consent regulations.

D

Deutsche Bank AG

deutsche-bank.de

64

Deutsche Bank AG is a leading financial institution offering a wide range of banking and investment services primarily targeting private, corporate, and institutional clients in Germany and internationally. The website reflects a mature digital presence with comprehensive service offerings, strong branding, and user-centric design. The technical infrastructure leverages Adobe Experience Manager CMS, Adobe Launch for tag management, and integrates advanced customer interaction tools such as Genesys widgets and Usercentrics for consent management. Security configurations are solid with valid SPF and DMARC policies, TLS 1.2 encryption with strong cipher suites, but could benefit from enhancements like TLS 1.3 support, HSTS, and DNSSEC. Privacy and cookie policies are well implemented with GDPR compliance, though explicit security and incident response policies are not publicly found. Overall, the site demonstrates a high level of professionalism, trustworthiness, and compliance with regulatory requirements.

F

Forteil GmbH

bonify.de

65

bonify.de is a German financial technology platform operated by Forteil GmbH, specializing in credit management and financial fitness services. The company provides users with free and transparent access to their SCHUFA credit data, credit scores, and personalized financial insights. With over 2.5 million users and certifications from TÜV Saarland and BaFin, bonify holds a strong market position in Germany's finance sector. The platform offers a comprehensive suite of services including credit monitoring, tenant credit reports, contract management, and credit offers, targeting consumers seeking to improve their financial health. Technically, bonify employs modern web technologies such as React with Next.js, Prismic CMS, and Cloudflare for hosting and DNS. The site integrates various third-party services including Google Tag Manager, Usercentrics for cookie consent, and Adjust for app marketing. Performance is moderate with good mobile optimization and SEO practices. Privacy compliance is well addressed with GDPR-aligned policies and cookie consent mechanisms. From a security perspective, bonify uses SSL encryption and domain verification but lacks advanced DNS security features like DNSSEC and HSTS. The DMARC policy is set to none, which could be strengthened to reduce email spoofing risks. The presence of a responsible disclosure page indicates security awareness, though no explicit incident response contacts were found. Overall, bonify.de demonstrates a mature digital presence with strong business and security fundamentals. Opportunities exist to enhance DNS and email security configurations and to publish more explicit security policies and incident response information to further build user trust and compliance posture.

D

DKB AG

dkb.de

61

DKB AG is a leading sustainable direct bank in Germany, offering a wide range of digital banking services including accounts, credit cards, loans, and investment products with a strong emphasis on renewable energy financing and social responsibility. The bank holds a prime ESG rating from ISS ESG, positioning it as a market leader in sustainable finance among the top 20 German banks. Technically, the website is built on modern frameworks such as Nuxt.js and Vue.js, hosted on AWS infrastructure, and uses Contentful as its CMS. The site demonstrates good performance and excellent mobile optimization, with comprehensive SEO and accessibility features. Security-wise, the site has a valid SSL certificate and properly configured SPF and DMARC records, but lacks DNSSEC and HSTS, which are recommended for enhanced security. The website employs Usercentrics CMP for cookie consent management and integrates analytics tools like Mapp Intelligence and Google Tag Manager, maintaining good privacy compliance. Overall, DKB AG's digital presence reflects a mature and professional organization with a strong commitment to sustainability and customer trust.

N

N26 SE

n26.com

72

N26 SE is a leading mobile-first bank headquartered in Germany, operating with a full German banking license and serving over 8 million customers across 24 markets. The company offers a range of financial products including free and premium bank accounts, instant savings linked to the European Central Bank rate, stock and ETF trading, and crypto investment powered by Bitpanda. Their digital-first approach is supported by a modern technology stack including React, Contentful CMS, and AWS hosting, ensuring a seamless and mobile-optimized user experience. Security is a core focus, with BaFin supervision, deposit protection up to €100,000, and advanced payment authentication methods such as 3D Secure and biometric verification. The website demonstrates strong privacy compliance with GDPR-aligned policies and cookie consent management via OneTrust. However, there are areas for improvement such as enabling HSTS, OCSP stapling, DNSSEC, and publishing a security.txt for vulnerability disclosure. Overall, N26 presents a mature digital banking platform with a solid security posture and a high level of trustworthiness in the fintech market.

H

Hypothekarbank Lenzburg AG

hbl.ch

67

Hypothekarbank Lenzburg AG is a Swiss regional bank offering a hybrid model of digital and personal banking services targeting private and corporate customers. The website reflects a mature digital presence with comprehensive service offerings including e-banking, mortgages, savings, investments, and financial planning. The bank positions itself as a trusted regional financial institution with a focus on customer-centric solutions. Technically, the website is built on Umbraco CMS and leverages modern frontend libraries such as Swiper, GSAP, and Cookiebot for consent management. However, the current SSL/TLS configuration is invalid, which poses a significant security risk and undermines user trust. Security headers like SPF and DMARC are properly configured, but the absence of DNSSEC, CAA, and HSTS reduces the overall security posture. The site employs extensive tracking and advertising technologies including Google Analytics, TikTok, and Meta Platforms, with a robust cookie consent mechanism ensuring GDPR compliance. Overall, the bank demonstrates a strong market position with a professional and user-friendly website but must urgently address SSL/TLS issues to maintain security and trust.

F

finleap

finleap.com

66

finleap is a fintech company builder based in Germany, established in 2014, that has built or invested in multiple fintech ventures and corporate joint ventures with a significant market valuation. The company targets fintech investors, startups, and corporate partners, positioning itself as an important player in the fintech ecosystem. The website is built on WordPress and hosted on Amazon AWS infrastructure, utilizing modern web technologies including Google Tag Manager and Usercentrics for consent management. Performance is moderate with good mobile optimization and SEO practices. Security posture is adequate with valid SSL, SPF, and DMARC configurations, but lacks advanced features such as HSTS and OCSP stapling, and does not have DNSSEC or CAA enabled. The site employs a cookie consent mechanism compliant with GDPR, enhancing privacy compliance. Overall, finleap demonstrates a professional and trustworthy online presence with room for security improvements.

F

Finch Capital

finchcapital.com

63

Finch Capital is a European growth investor specializing in Business and Financial Technology sectors, supporting entrepreneurs with capital and strategic guidance to scale their businesses. The firm manages €450 million in assets and has a portfolio of over 45 companies. Their services include growth capital investment, active portfolio management, and support in areas such as hiring, M&A, go-to-market strategies, capital raising, regulation, and international expansion. Technically, the website is built on modern frameworks like React and Next.js, hosted on DigitalOcean, but suffers from an invalid SSL certificate and lacks several security headers, indicating room for improvement in security posture. The firm uses Google Tag Manager for analytics and tracking, but lacks a visible cookie consent mechanism. Overall, Finch Capital presents a professional and trustworthy image with strong domain expertise and a commitment to sustainable investment.

B

Banrisul - Banco do Estado do Rio Grande do Sul, S.A.

banrisul.com.br

59

Banrisul is a large, state-owned multiple bank operating primarily in the southern region of Brazil, specifically Rio Grande do Sul. It offers a range of banking and financial services including commercial banking, development banking, leasing, real estate credit, financing, and investment. The website serves as a portal for internet banking and related services, targeting residents and businesses in its regional market. The business model focuses on public banking services with a regional market position. Technically, the website infrastructure appears outdated, using framesets and lacking modern web technologies or CMS indicators. Performance is moderate but mobile optimization and accessibility are poor. The absence of modern security protocols and an invalid SSL certificate indicate significant technical debt and security risks. No advanced frameworks or analytics tools are detected, and SEO is basic. From a security perspective, the site lacks a valid SSL certificate and does not support any TLS protocols, exposing users to potential risks. There are no HTTP security headers, no privacy or cookie policies, and no visible incident response or vulnerability disclosure mechanisms. This reflects a low security maturity level and potential compliance gaps with data protection regulations. Overall, the website requires urgent improvements in security posture, modernization of technical infrastructure, and implementation of privacy and compliance policies to enhance trust and protect users. Strategic investments in security and digital modernization are recommended to align with industry standards and regulatory requirements.

P

PricewaterhouseCoopers

pwcplus.de

67

PwC Plus is a specialized knowledge and research platform operated by PricewaterhouseCoopers, targeting primarily financial services professionals with additional focus on healthcare and public services sectors. The platform offers subscription-based access to quality-assured, daily updated content including legal norms monitoring, regulatory insights, and sector-specific modules. The website demonstrates a mature digital presence with multilingual support, user account management, and integration of professional content from trusted partners such as the IFRS Foundation. Technically, the site is hosted on Colt's infrastructure, uses modern TLS protocols, and employs Piwik PRO for analytics with a compliant cookie consent mechanism. Security posture is solid with DMARC enforcement and no critical SSL vulnerabilities, though improvements like enabling HSTS, DNSSEC, and CAA records could enhance security further. No explicit security or incident response policies are published, indicating an area for maturity growth. Overall, PwC Plus presents a professional, trustworthy, and content-rich platform aligned with PwC's global brand standards.

M

MP Agregador, S. de R.L. de C.V.

mercadopago.com.mx

65

Mercado Pago México operates as a leading digital financial services platform under the Mercado Libre group, offering a comprehensive suite of services including digital accounts, credit cards, personal loans, and payment processing solutions tailored for individuals and businesses in Mexico. The platform integrates with Mercado Libre's e-commerce ecosystem, positioning itself as a key player in Latin America's fintech landscape. Technically, the website employs modern web technologies such as React-based frameworks, New Relic monitoring, and various analytics and marketing tools, hosted on Amazon AWS infrastructure with Cloudfront CDN. Security measures include valid SPF and DMARC records, TLS 1.2 and 1.3 support, and absence of major SSL vulnerabilities, although improvements are recommended in HSTS enforcement and OCSP stapling. A subdomain takeover vulnerability was detected on the blog subdomain, representing a potential risk. Overall, the site demonstrates good digital maturity, strong branding, and extensive user tracking for analytics and marketing purposes.

M

MercadoPago S.A.

mercadopago.cl

66

MercadoPago S.A. is a leading digital payment platform in Chile, operating as part of the MercadoLibre ecosystem. The company offers a comprehensive suite of financial services including digital accounts, prepaid Mastercard cards, instant money transfers, and payment acceptance solutions for both individuals and businesses. Its market position is strong, serving a broad audience with a focus on seamless online payment processing and financial management. The website reflects a mature digital infrastructure with modern technologies such as React, New Relic for monitoring, and Google Tag Manager for marketing and analytics. Despite a generally strong security posture with strict DMARC and SPF policies and HSTS enabled, the site has an invalid SSL certificate and a subdomain takeover vulnerability on its blog subdomain, which are critical issues to address. Overall, the platform demonstrates high professionalism, excellent user experience, and good compliance with privacy and cookie policies, but should prioritize remediating its SSL and subdomain security gaps to maintain trust and security.

Q

Qwist GmbH

qwist.com

63

Qwist GmbH is a leading open finance platform operating primarily in the DACH and Iberian markets, offering a comprehensive suite of B2B2X financial technology products. Their key offerings include digital account and portfolio switching, open banking compliance solutions, financial data analytics, and digital lending integration. The company positions itself as the #1 open finance company in its region, serving major banks and financial institutions with a strong investor backing from Finch Capital and Finleap. Technically, the website is built on WordPress with the Divi theme and leverages modern marketing and analytics tools such as HubSpot, Matomo, and SalesLoft. The site employs GDPR-compliant cookie consent via Cookiebot and maintains a valid SSL certificate, although some security enhancements like HSTS and DNSSEC are absent. Performance is moderate with good mobile optimization and SEO practices. From a security perspective, Qwist demonstrates solid foundational practices including SPF and DMARC email protections and encrypted communications. However, the absence of advanced DNS security measures and a public security or incident response policy suggests room for improvement. No critical vulnerabilities were detected in the current analysis. Overall, Qwist presents a professional and trustworthy digital presence aligned with its market leadership in open finance. Strategic security enhancements and transparency in incident response would further strengthen its risk posture and customer confidence.

I

If P&C Insurance AS

if.ee

68

If P&C Insurance AS operates the website if.ee, providing a broad range of insurance products and services targeted at both private individuals and business clients in Estonia. The company offers various insurance types including vehicle, home, travel, accident, and pet insurance, positioning itself as a leading insurance provider in the Baltic region. The website is multilingual and designed to facilitate online insurance purchases and claims management, reflecting a mature digital business model. Technically, the site leverages Microsoft Azure DNS, Episerver CMS, and integrates advanced analytics tools such as Microsoft Application Insights and Google Tag Manager. However, the absence of a valid SSL certificate and lack of modern TLS protocols represent significant security weaknesses that could undermine user trust and data protection. The site demonstrates good compliance with GDPR and cookie regulations, including explicit cookie consent mechanisms and published privacy policies. Contact information is clearly provided, including a company email and phone number, alongside active social media channels. Overall, the website reflects a professional and comprehensive insurance service platform but requires urgent security improvements to ensure safe and trusted user interactions.

I

If P&C Insurance AS filialas

if.lt

55

If P&C Insurance AS filialas operates the website if.lt, providing a wide range of insurance products including automobile, home, pet, travel, personal, and business insurance primarily targeting private individuals and businesses in Lithuania. The company is positioned as a leading insurance provider in the Baltic region, offering online services and customer self-service portals. The website is well-branded and provides comprehensive information about insurance products and customer support. Technically, the site uses a mix of technologies including jQuery, Microsoft Application Insights, OneTrust for cookie consent, and Google Tag Manager, hosted on Microsoft Azure DNS infrastructure. However, the website suffers from a critical security issue due to the absence of a valid SSL certificate and lack of modern TLS protocol support, which undermines secure communications and user trust. The site demonstrates good GDPR compliance with detailed privacy and cookie policies and active consent mechanisms. Performance is slow with a high page load time and large page size, but mobile optimization and accessibility are well addressed. Overall, the security posture requires urgent improvement to protect user data and maintain trust.

K

KM Business Information Australia Pty Ltd

brokernews.com.au

65

Australian Broker News, operated by KM Business Information Australia Pty Ltd, is a specialized online media platform delivering mortgage industry news, insights, and premium content targeted at Australian mortgage brokers and finance professionals. The website serves as a leading source of industry updates, lender product news, and expert commentary, positioning itself as a trusted resource within the Australian finance sector. The business model revolves around content publishing, premium subscriptions, event coverage, and advertising revenue. Technically, the site leverages modern JavaScript libraries, Algolia search, and Google advertising technologies, hosted behind Cloudflare DNS services. However, the website exhibits a slow load time and lacks a valid SSL certificate, which impacts user trust and security posture. Security configurations include valid SPF and DMARC email protections but lack DNSSEC and modern TLS implementations. The absence of published security policies and incident response information indicates a gap in transparency and readiness. Overall, the site maintains good content quality and user experience but requires significant improvements in security and performance to enhance trust and compliance.

M

Mercado Pago Instituição de Pagamento Ltda.

mercadopago.com.br

61

Mercado Pago is a leading digital bank and payment platform in Brazil, operating as a subsidiary of Mercado Libre, the largest e-commerce company in Latin America. The platform offers a comprehensive suite of financial services including digital accounts, credit cards, loans, and payment processing solutions tailored for both individuals and businesses. The website demonstrates a strong market position with a focus on user experience, accessibility, and comprehensive service offerings. Technically, the site employs modern web technologies such as React-based frameworks, New Relic for monitoring, and integrates multiple analytics and advertising tools. Security headers are well implemented, though the SSL certificate is currently invalid, which poses a risk to secure communications. Privacy and cookie policies are present and indicate compliance with GDPR standards. Overall, the platform exhibits a mature digital infrastructure with extensive tracking and marketing integrations, balanced with clear privacy disclosures.

T

Tomorrow GmbH

tomorrow.one

67

Tomorrow GmbH is a sustainable mobile banking service provider operating primarily in Germany and select European countries. The company offers a range of bank accounts focused on sustainability, including the Now, Change, and Zero accounts, as well as investment products and savings accounts with competitive interest rates. Their market position is that of a challenger bank with a strong emphasis on climate protection and social impact, supported by a regulated banking partner, Solaris SE. The website demonstrates a mature digital presence with excellent content quality, user experience, and SEO optimization. However, a critical security gap exists due to the absence of a valid SSL certificate and lack of HTTPS support, which undermines user trust and data security. The company has implemented privacy and cookie policies with consent mechanisms, and holds a B Corp certification, enhancing its trustworthiness. Strategic partnerships with Solaris SE, lemon.markets, and Qwist strengthen its service offerings and operational capabilities.

S

Simplicity Wealth

simplicitywealth.com

64

Simplicity Wealth is a financial advisory firm focused on partnering with advisors to provide personalized investment and financial planning services. The company emphasizes bespoke investment experiences tailored to individual investor needs, leveraging proprietary risk assessment tools such as Value at Risk (VaR) analysis and AssetLock portfolio monitoring. Positioned as an SEC-registered investment adviser, Simplicity Wealth targets financial advisors and their investor clients, aiming to build confidence and discipline in investment strategies. Technically, the website is built on WordPress using the Avada theme, with SEO optimization via Yoast and marketing integrations including Google Analytics and Marketo. The site is hosted behind Cloudflare, providing DNS and CDN services. Security posture is moderate with a valid SSL certificate but lacks modern TLS protocols, security headers, and DNSSEC. Privacy and terms of service documents are present, but no explicit cookie consent mechanism or vulnerability disclosure policy is found. Overall, the website presents a professional and trustworthy front but could improve its security and compliance posture.

K

KM Business Information US, Inc.

investmentnews.com

64

InvestmentNews is a leading financial media platform focused on providing news, analysis, and resources for independent financial advisors and wealth managers in the United States. The company operates a subscription-based business model offering premium content, events, webinars, and data services. Their market position is strong within the financial advisory sector, supported by a consistent brand and good content quality. Technically, the website leverages a modern JavaScript stack with React, integrates multiple third-party marketing and analytics tools including Algolia, HubSpot, and Azure Application Insights, and is hosted behind Cloudflare. Security posture is adequate with a valid SSL certificate and bot protection via reCAPTCHA Enterprise; however, there are notable gaps such as disabled modern TLS versions, lack of HSTS, DNSSEC, and a subdomain takeover vulnerability on a development subdomain. Privacy and cookie policies are present and GDPR compliant with a consent mechanism. Overall, the site demonstrates good professionalism and trustworthiness but would benefit from addressing security vulnerabilities and enhancing HTTPS configurations.

M

MercadoLibre S.R.L.

mercadopago.com

73

Mercado Pago is a leading digital payments platform operating primarily in Latin America, with a strong presence in Argentina. It offers a comprehensive suite of financial services including digital accounts, prepaid Mastercard cards, money transfers, payment of services, loans, and seller tools such as Point devices and QR code payments. The platform is integrated with its parent company MercadoLibre, a major e-commerce player in the region, positioning Mercado Pago as a critical enabler of digital commerce and financial inclusion. Technically, the website leverages modern web technologies, including React-based frameworks, New Relic for performance monitoring, and Google Tag Manager for analytics and marketing. The SSL configuration is robust with a valid certificate and HSTS enabled, although DNSSEC is not enabled and CAA records appear misconfigured. No critical vulnerabilities were detected, but there is room for improvement in DNS security and explicit vulnerability disclosure. Overall, Mercado Pago demonstrates a mature digital infrastructure and a strong security posture, supporting its role as a trusted financial services provider.

V

Vindi

vindi.com.br

64

Vindi is a leading Brazilian payment hub platform specializing in managing and processing online payments, with a strong focus on recurring billing, e-commerce, and financial services. The company offers a comprehensive suite of services including payment gateways, credit lines, antifraud solutions, and APIs for seamless integration with marketplaces and other platforms. Their market position is reinforced by significant transaction volumes and a portfolio of reputable clients. Technically, the website is hosted on Amazon S3 with CloudFront CDN, uses modern frontend frameworks like Bootstrap, and integrates Google Tag Manager for analytics and marketing. The site demonstrates good SEO and mobile optimization practices. Security-wise, Vindi maintains a valid SSL certificate and avoids known SSL vulnerabilities, but lacks enabled TLS protocols and HSTS, and DNSSEC is not configured, indicating areas for improvement. Overall, the company shows a mature digital presence with strong branding and trust signals, though security hardening and compliance transparency could be enhanced.

T

The Leaders Group, Inc.

leadersgroup.net

59

The Leaders Group, Inc. is a prominent broker-dealer specializing in the insurance and financial services industry. They provide brokerage general agents, independent marketing organizations, and independent insurance agents with access to major insurance carriers and product providers. Recognized nationally for growth and revenue, they offer business-friendly compliance, competitive payouts, and personalized support, positioning themselves as a growth partner for financial professionals including registered representatives and RIAs. Their website reflects a professional and consistent brand with good content quality and clear navigation.

L

LexisNexis Risk Solutions

bankersalmanac.com

75

Bankers Almanac is a specialized portal operated by LexisNexis Risk Solutions, providing financial institutions with access to banking data and KYC compliance tools. Positioned as an enterprise-grade service, it supports risk management and regulatory compliance needs for banking professionals. The website serves primarily as a login gateway to these services, integrating modern authentication via Auth0 and linking to corporate LexisNexis resources. Technically, the site employs standard web technologies but lacks modern TLS protocol support and DNSSEC, which are areas for improvement. Security posture is solid with valid SSL and HSTS enabled, but could benefit from enhanced security headers and DNS protections. Overall, the site demonstrates a professional and trustworthy presence aligned with enterprise financial services.

S

Solarisbank AG

solarisgroup.com

72

Solarisbank AG operates as a leading embedded finance platform in Europe, providing a comprehensive Banking-as-a-Service solution that enables businesses to integrate digital banking, payments, lending, and identification services via advanced APIs. The company holds a full German banking license, allowing it to operate across the EU with a strong compliance and regulatory framework. Solarisbank's market position is reinforced by partnerships with notable clients such as American Express and Tomorrow, and a clear focus on customer-centric financial product innovation. Technically, Solarisbank employs modern web technologies including React and Gatsby, hosted on AWS infrastructure, with a cloud-based banking platform emphasizing scalability and international expansion. The website demonstrates good performance, mobile optimization, accessibility, and SEO practices, supported by a robust API-driven backend. From a security perspective, Solarisbank maintains a valid SSL certificate, enforces HSTS with preload, and implements SPF DNS records. However, the absence of enabled TLS 1.2 or higher protocols and lack of DNSSEC and CAA records present areas for improvement. The company provides clear privacy policies, cookie consent mechanisms, and incident response contact channels, reflecting a mature security posture. Overall, Solarisbank presents a high-trust, professional digital presence with strong business and technical foundations. Strategic enhancements in security protocols and transparency around vulnerability disclosures would further strengthen its risk profile and customer confidence.

V

Volkswagen Financial Services

volkswagen-versicherungsdienst.de

65

Volkswagen Financial Services AG operates the volkswagen-versicherungsdienst.de website, providing a comprehensive portfolio of automotive insurance products including liability, partial and full coverage, warranty extensions, leasing rate insurance, credit protection, and travel insurance. The site targets primarily German private and business customers, leveraging the strong Volkswagen brand and integrated financial services ecosystem. The website is built on Adobe Experience Manager with extensive use of modern web technologies and content delivery networks, ensuring excellent performance and user experience. However, the SSL configuration is critically flawed with a self-signed certificate and no enabled TLS protocols, which undermines secure communications. Security headers are well implemented, but the absence of a cookie consent mechanism and explicit security or incident response policies indicates gaps in compliance and transparency. The site integrates multiple marketing and analytics tools, including Adobe Analytics, Google Tag Manager, and UserZoom, reflecting extensive user tracking. Overall, the site is professional, content-rich, and trustworthy from a business perspective but requires urgent security improvements to protect user data and comply with best practices.

V

Volkswagen Financial Services AG

volkswagen-bank.de

65

Volkswagen Financial Services AG operates a comprehensive digital platform offering automotive financial services including leasing, financing, insurance, and mobility solutions primarily targeting private and business customers in Germany. The website demonstrates a mature digital infrastructure leveraging Adobe Experience Manager, advanced analytics, and multiple integrations with marketing and tracking tools. However, the security posture is weakened by an invalid self-signed SSL certificate and disabled TLS protocols, which pose significant risks to secure communications. The site includes strong security headers and content policies but lacks visible cookie consent mechanisms and explicit security or incident response policies. Overall, the platform is professionally designed, content-rich, and well-branded, supporting a leading position in automotive financial services within the Volkswagen Group ecosystem.

I

iPipeline

ipipeline.com

64

iPipeline is a leading enterprise software provider specializing in life insurance, annuities, and wealth management solutions. Their platform offers end-to-end digital automation designed to streamline workflows from quote to commission, serving a broad audience including carriers, broker-dealers, RIAs, and financial institutions. The company positions itself as a trusted industry leader with a large global user base and extensive data integration capabilities. Technically, the website is built on a modern WordPress CMS with Elementor, leveraging multiple marketing and analytics tools such as HubSpot and Google Tag Manager. Security posture is generally good with valid SSL and security headers, but the absence of enabled TLS protocols and HSTS indicates room for improvement. Cookie consent is implemented via OneTrust, supporting GDPR compliance. Overall, the site demonstrates strong branding, excellent content quality, and a professional user experience.

S

Simplicity Group

simplicitygroup.com

62

Simplicity Group is a leading financial services distribution partnership focused on providing advisors, financial institutions, and consumers with wealth accumulation and financial protection products. Founded in 2016, it has rapidly grown to become a prominent player in the financial services industry, leveraging a partnership and employee-ownership business model. The company offers a comprehensive suite of services including marketing, practice management, wealth management, and specialized financial education, targeting a broad audience from independent agents to banks and broker dealers. Technically, the website is built on WordPress with a modern theme and plugins, hosted on WP Engine and protected by Cloudflare CDN. The site employs Google Analytics, Tag Manager, and Pardot for marketing and analytics, and includes accessibility features. Security posture is solid with a valid SSL certificate and no known vulnerabilities, though it lacks modern TLS protocols and advanced DNS security features. Privacy and terms policies are comprehensive and prominently presented, supporting GDPR and CCPA compliance. Overall, the website reflects a mature digital presence with good user experience and trust indicators.

B

Bettr

bettrfinancing.com

69

Bettr Financing is a digital lending platform operated by Ant International, focused on providing quick and hassle-free micro-loans to MSMEs across multiple markets including Brazil, Hong Kong, Thailand, and Vietnam. The company leverages technology and innovation to simplify access to financing, positioning itself as a key enabler for small business financial progress. The website reflects a modern technical infrastructure using React and Ant Design frameworks, hosted on Alibaba Cloud services, and incorporates performance and error monitoring tools. Security posture is strong with a valid GlobalSign SSL certificate and multiple security headers, although the lack of modern TLS protocol support and absence of visible privacy and cookie policies indicate areas for improvement. The site collects user contact information via forms but lacks explicit data protection disclosures. Overall, Bettr demonstrates a solid digital presence with room to enhance compliance and security transparency.

A

Alipay+

alipayplus.com

69

Alipay+ is a global digital payment platform operated by Ant International, providing cross-border mobile payment solutions and digitalization technologies to millions of consumers and businesses worldwide. The platform enables seamless payments via multiple e-wallets and banking apps, targeting global brands, mobile payment providers, and merchants. Their extensive partner ecosystem and large consumer base position them as a significant player in the financial technology sector. Technically, the website leverages modern web technologies including React and Next.js, hosted on Alibaba Cloud infrastructure with CDN acceleration, ensuring fast and mobile-optimized user experiences. Security posture is generally strong with valid SSL certificates, HSTS enabled, and no detected major vulnerabilities. However, the absence of TLS 1.2+ protocols and DNSSEC implementation are notable gaps. Privacy and cookie policies are present and appear GDPR compliant, but explicit security and incident response policies are not publicly disclosed. Overall, Alipay+ demonstrates a mature digital presence with strong branding, comprehensive service offerings, and a good security baseline, though some improvements in security protocols and transparency could enhance trust and compliance.