Finance security reports

C

Citadele pank

citadeleleasing.ee

46

Citadele pank is a well-established financial institution in Estonia offering leasing services primarily focused on vehicle financing. The website provides detailed leasing options, including a calculator and a dedicated leasing portal for customers to manage their contracts and applications. The business targets private individuals seeking flexible leasing solutions with personalized interest rates and competitive terms. The company is part of the larger Citadele Group, indicating a strong market position in the Baltic financial sector. Technically, the website employs modern web technologies such as jQuery, Bootstrap, and Google Tag Manager, with a CMS likely being October CMS. The site is mobile-optimized, accessible, and SEO-friendly, providing a good user experience. Security-wise, the site enforces HTTPS, uses security headers, and implements cookie consent mechanisms, though explicit security and incident response policies are not publicly available. WHOIS data confirms the domain's legitimacy and consistency with the business identity. Overall, the website reflects a professional and trustworthy financial service provider with room for improvement in transparency around security policies and incident response.

C

Citadele

xrewards.ee

68

The website www.xrewards.ee represents the C REWARDS loyalty and discount program affiliated with Citadele bank, targeting C card holders primarily in Estonia and the Baltic region. The platform offers users the ability to earn points on purchases and redeem them for discounts and prizes, integrating banking services with retail loyalty. The website is built on Magento CMS with modern frontend technologies including RequireJS and jQuery, and is monitored using New Relic and Google Tag Manager. The site is well-optimized for mobile devices and provides a good user experience with clear navigation and professional design. Security posture is strong with HTTPS enforced and appropriate security headers, though explicit security policies and incident response contacts are not published. Privacy and cookie policies are comprehensive and GDPR compliant, with active consent mechanisms. Overall, the site demonstrates a mature digital infrastructure aligned with the business goals of Citadele bank's loyalty program.

R

RSJ

rsj.com

56

RSJ is a financial group operating primarily in the Czech Republic with a strong presence in global derivative markets including London, Chicago, New York, Frankfurt, and Tokyo. The company manages a diversified portfolio of investments spanning financial derivatives trading, real estate development, private equity, and emerging sectors such as biotechnology and healthy food production. The website clearly communicates its business scope and warns investors about fraudulent schemes misusing its brand. Technically, the site employs modern web technologies including Google Analytics and Tag Manager, with a cookie consent mechanism supporting GDPR compliance. Security posture is solid with HTTPS enforced, but lacks published security policies or incident response contacts. WHOIS data is missing, which raises concerns about domain registration legitimacy despite the professional website presence. Overall, RSJ presents as a credible financial entity with room for improvement in transparency and security disclosures.

Credy operates as a financial affiliate network specializing in consumer loans, connecting publishers and advertisers with lenders across multiple countries. The company positions itself as a leader in the consumer credit advertising market with a focus on short-term loans and related financial products. The website content is professionally presented, targeting publishers and advertisers seeking monetization and lead generation opportunities. The business is registered as Traffic Control OÜ in Estonia, with a physical address and contact email provided, supporting its legitimacy from a business perspective. Technically, the website uses modern frontend technologies including Bootstrap, jQuery, and Slick Carousel, delivering a responsive and user-friendly experience. However, the absence of visible privacy and cookie policies, as well as missing WHOIS registration data, raises concerns about compliance and domain legitimacy. Security posture is moderate with no visible vulnerabilities but lacks security headers and formal policies. Overall, the site is functional and professional but requires improvements in compliance and domain registration transparency to enhance trust.

E

EuPlătesc

euplatesc.ro

45

EuPlătesc.ro is a Romanian online payment processor with nearly two decades of experience providing secure and innovative payment solutions to businesses. The company offers a variety of payment methods including card payments, recurring payments, installment payments, QR code payments, and SMS payments, positioning itself as a comprehensive payment service provider in the Romanian market. The website is professionally designed using WordPress and Elementor, featuring modern SEO practices and mobile optimization. Security is emphasized through the use of HTTPS and 3DSecure authentication technology, although explicit security policies and incident response contacts are not publicly available. Privacy compliance is partially addressed with a cookie consent mechanism, but a dedicated privacy policy page is not clearly found. Overall, the website presents a credible and trustworthy business presence with room for improvement in transparency and security documentation.

X

xMoney

utrust.com

72

xMoney is a financial technology company offering a comprehensive payment ecosystem that empowers businesses to accept global payments, manage finances, and issue branded cards. The platform targets merchants and enterprises across Europe and beyond, providing services such as payments, recurring billing, marketplaces, invoicing, and crypto payment acceptance. The company positions itself as a licensed and compliant entity with certifications including PCI DSS Level 1 and MiCA compliance, regulated by the Bank of Romania. The website reflects a mature digital presence with professional design, clear navigation, and extensive product information. Technically, xMoney leverages modern web technologies including Webflow CMS, Google Tag Manager, Microsoft Clarity, and Bing Ads for analytics and marketing. The site is well-optimized for performance, mobile responsiveness, and accessibility. Security practices are strong, with HTTPS enforced, advanced fraud prevention powered by AI, and compliance with payment security standards. However, explicit security headers and incident response disclosures could be improved. The security posture is robust but slightly diminished by the absence of WHOIS registration data, which raises questions about domain legitimacy. No WAF or blocking mechanisms were detected, and the site is fully accessible. Privacy compliance is well addressed with cookie consent mechanisms and a comprehensive privacy policy. Overall, xMoney presents a trustworthy and professional payment platform with strong technical and security foundations. Strategic recommendations include enhancing visible security headers, publishing vulnerability disclosure and incident response information, and clarifying domain registration details to improve trust and compliance transparency.

L

Luminor Bank AS

luminor.lv

46

Luminor Bank AS operates a comprehensive banking website targeting private individuals and businesses in Latvia, offering a wide range of financial services including loans, savings, insurance, and internet banking. The website is professionally designed with consistent branding and clear navigation, supporting multiple languages. The technical infrastructure is based on Drupal CMS with modern JavaScript libraries and Google analytics tools integrated, alongside a robust cookie consent mechanism powered by OneTrust. Security posture is strong with HTTPS enforced, appropriate security headers, and no visible vulnerabilities or exposed sensitive data. Privacy compliance is well addressed with clear privacy and cookie policies, and GDPR adherence is evident. However, explicit incident response contact details and vulnerability disclosure mechanisms are not found, representing an area for improvement. Overall, the website reflects a mature digital presence suitable for a large financial institution with high trustworthiness and good user experience.

O

Oreon OÜ

bestcredit.ee

52

BestCredit.ee is an established Estonian financial services company operating since 2011 under Oreon OÜ. The company offers a variety of loan products including small consumer loans, business loans, mortgage loans, guarantee loans, and construction loans. Their business model focuses on online lending with self-service features and loan calculators to facilitate customer engagement. The website targets both private individuals and businesses within Estonia, positioning itself as a reliable and professional lender with a clear regulatory license from the Estonian Financial Supervision Authority.

B

Birdeye Capital

birdeyecapital.com

50

Birdeye Capital is a specialized alternative investment fund manager focusing on sustainable forestland investments. Established in 2013 and regulated by the Estonian Financial Supervision Authority, the company offers non-public, closed-ended funds tailored for institutional investors such as pension funds and family offices. Their business model emphasizes long-term sustainable growth and ESG compliance, positioning them as a trusted player in the Baltic investment market. Technically, the website is built on WordPress with modern plugins and libraries, providing a good user experience and mobile optimization. Security posture is solid with HTTPS and domain transfer protections, though lacking advanced security headers and explicit security policies. Privacy compliance is weak due to missing privacy and cookie policies. Overall, the website is professional and trustworthy but would benefit from enhanced privacy and security disclosures.

C

Citadele

citadele.ee

57

Citadele is a well-established banking institution operating in Estonia, providing a broad range of retail banking services including loans, deposits, insurance, and payment solutions tailored to individual customers. The website reflects a mature digital presence with comprehensive content, including loan calculators and detailed product offerings, targeting private banking customers. The company maintains a consistent brand image and integrates social media and partner links effectively. Technically, the site uses modern JavaScript libraries such as jQuery and Bootstrap, and is likely powered by OctoberCMS, ensuring a responsive and user-friendly experience. Security is robust with HTTPS enforced, secure cookie consent mechanisms, and standard security headers, although explicit security policies and incident response information are not publicly available. Overall, the site demonstrates good compliance with privacy regulations and provides clear contact information, supporting a trustworthy user experience.

S

Savantor Ltd

savantor.com

54

Savantor Ltd is a specialized consulting and resourcing firm focused on the payments, cards, mobile, banking, and transactions sectors. With over 25 years of experience, the company offers expert services including specialist resourcing, payments strategy, platform selection and transition, and operational efficiency. Their client base includes major financial institutions and payment networks, positioning them as a trusted advisor in the European and UK markets. The website reflects a professional and well-structured digital presence, leveraging WordPress and Elementor technologies, with good mobile optimization and SEO practices. Privacy and cookie policies are comprehensive and GDPR compliant, supported by a consent mechanism. Security posture is strong with HTTPS enforced and no visible vulnerabilities, though security headers could be improved. The absence of WHOIS registration data is a notable anomaly that requires further investigation to confirm domain legitimacy. Overall, the website and business present a credible and professional image with minor technical and security enhancements recommended.

M

Mandatum

mandatumlife.fi

61

Mandatum is a prominent Finnish financial services group specializing in investment management, insurance, pension solutions, and employee reward services. The company positions itself as a unique combination of financial expertise and human-centric service, targeting individual customers, businesses, and entrepreneurs. Their market position is strong within Finland, supported by a comprehensive portfolio of services and a large professional workforce. The website reflects a mature digital presence with multilingual support and rich content tailored to diverse customer segments. Technically, the website employs modern frameworks such as Vue.js and Tailwind CSS, integrated with advanced analytics and marketing tools including Adobe Analytics, Microsoft Application Insights, and OneTrust for cookie consent management. The platform appears to be built on Episerver CMS, ensuring robust content management and search capabilities. Mobile optimization and accessibility are well addressed, providing a seamless user experience across devices. From a security perspective, the site enforces HTTPS and incorporates cookie consent mechanisms aligned with GDPR requirements. While explicit security headers are not visible in the provided data, the presence of security policy pages and incident reporting channels indicates a proactive security posture. No critical vulnerabilities or suspicious activities were detected. However, improvements such as publishing a security.txt file and providing direct incident response contact emails could enhance transparency and readiness. Overall, Mandatum's website demonstrates high professionalism, trustworthiness, and compliance with privacy regulations. The digital infrastructure supports business goals effectively, though minor enhancements in security transparency and incident response communication are recommended to further strengthen their security posture.

J

Just another WordPress site

efa.biz

48

EFA Platform is a specialized financial research database management and publication platform targeting equity, fixed income, and multi-asset analyst teams. The website presents a professional and modern design built on WordPress with the Divi theme, incorporating essential SEO metadata and client trust indicators such as logos and demo requests. Technically, the platform uses standard web technologies including Google reCAPTCHA for form protection, but lacks visible advanced security headers and privacy compliance mechanisms. The absence of WHOIS registration data raises concerns about domain legitimacy, although the site content and structure suggest an operational business. Overall, the security posture is moderate with room for improvement in privacy and transparency. Strategic recommendations include adding privacy and cookie policies, improving security headers, and clarifying domain registration details to enhance trust.

C

CostPocket

tsekk.ee

62

CostPocket is a medium-sized Estonian SaaS company specializing in digital expense management solutions for businesses and accounting professionals. Their platform offers AI-powered tools to digitize receipts, automate expense reporting, and integrate seamlessly with popular accounting software, positioning them as a key player in the Baltic financial technology sector. The website demonstrates a modern technical infrastructure using Vue.js and integrates multiple analytics and marketing tools, reflecting a mature digital presence. Security posture is strong with HTTPS, security headers, and Cloudflare DNS, though some improvements in DNSSEC and explicit security policies are recommended. Privacy compliance is basic, with cookie consent implemented but lacking explicit privacy and terms of service pages. Overall, the site is professional, trustworthy, and well-optimized, supporting a strong market position.

M

Moneyzen

moneyzen.eu

56

Moneyzen is an Estonian-based online lending and investment platform that offers a variety of personal loans and investment opportunities. The company positions itself as a transparent and empathetic financial intermediary connecting borrowers and investors. The website is professionally designed using WordPress and Elementor, featuring loan and investment calculators, clear navigation, and multilingual support. The business targets individuals seeking flexible loans and investors looking for peer-to-peer lending options. The platform has a clear market niche in Estonia's finance sector with a small company size and a consistent brand presence. Technically, the website employs modern web technologies including WordPress 6.8.1, Elementor 3.29.2, Yoast SEO, Google Tag Manager, Facebook Pixel, Hotjar, and reCAPTCHA for security and analytics. The site is mobile-optimized and SEO-friendly, though some security headers could be enhanced. Cookie consent mechanisms and privacy policies indicate good GDPR compliance. From a security perspective, the site uses HTTPS with good SSL configuration and implements standard best practices such as reCAPTCHA and cookie consent. However, explicit security policies and incident response information are not found, and security headers like CSP and X-Frame-Options are not explicitly detected. No vulnerabilities or exposed sensitive data were identified in the HTML content. Overall, Moneyzen presents a trustworthy and professional online financial service with solid technical infrastructure and privacy compliance. Strategic improvements in security headers and incident response transparency would further strengthen its security posture and user trust.

D

Domains By Proxy, LLC

operose.io

58

Operose is a newly founded blockchain company (2024) focused on creating a peer-to-peer marketplace for commodity-backed tokens aimed at transforming commerce and fostering financial inclusivity. The website presents a professional and consistent brand image targeting investors interested in blockchain financial products. Technically, the site uses modern web technologies including React, Font Awesome, Google Analytics, OpenReplay, and LiveChat, hosted behind Cloudflare DNS. Security posture is moderate with HTTPS enabled and domain status protections, but lacks DNSSEC and security headers. Privacy compliance is partial with a privacy policy present but no cookie consent mechanism. Overall, the site is accessible and functional with room for improvement in security and compliance.

E

Estonian Private Equity And Venture Capital Association

estvca.ee

54

EstVCA (Estonian Private Equity And Venture Capital Association) is a professional association representing the private equity and venture capital industry in Estonia and the Baltic region. The website serves as an information hub providing news, reports, events, and educational resources targeted at investors, fund managers, startups, and other stakeholders in the PE/VC ecosystem. The association is well-established since 2010 and maintains a consistent brand presence online. Technically, the website is built on the Voog CMS platform, utilizing JavaScript libraries such as jQuery and Modernizr, and is hosted on servers managed by Edicy OÜ. The site is mobile-optimized with responsive images and basic accessibility features. Performance is moderate, with no major technical issues detected. SEO is basic but present through meta tags and Open Graph data. From a security perspective, the site enforces HTTPS and does not expose sensitive data. However, it lacks important security headers and uses an outdated jQuery version, which could pose risks. There are no visible privacy or cookie policies, nor contact information for security incidents or data protection officers, indicating gaps in compliance and transparency. Overall, the website is functional and professional but would benefit from enhanced privacy compliance, improved security headers, updated libraries, and clearer contact information to strengthen trust and security posture.

F

FB Asset Management

fbassets.eu

46

FB Asset Management is a small Estonian investment fund management company established in 2013. The company manages investment funds licensed by the Estonian Financial Supervision Authority and targets professional and experienced investors with funds such as FB Opportunity Fund and FB Corporate Bond Fund. The website is built on WordPress using Elementor and Yoast SEO, indicating a modern and maintainable technical infrastructure. Google Analytics is used for visitor tracking, but no cookie consent mechanism or privacy policy is present, representing a compliance gap. Security posture is good with HTTPS enabled and no visible vulnerabilities, but lacks security headers and incident response information. Overall, the website is professional and trustworthy but should improve privacy compliance and security transparency.

O

OÜ MyFinancier

myf.ee

42

MyFinancier is a small Estonian company providing an intelligent personal finance assistant service that helps users analyze cash flows and gain detailed insights into asset distribution. The website is professionally designed using WordPress with Elementor and optimized for SEO and mobile devices. It targets Estonian individuals seeking financial management tools. The company maintains a consistent brand presence with active social media profiles on Facebook, LinkedIn, and YouTube. The domain is registered with Elkdata OÜ since 2018, aligning with the business age and location. Technically, the site uses modern web technologies, including Google Analytics and Facebook Pixel for analytics and marketing, with a compliant cookie consent mechanism.

E

Estateguru OÜ

estateguru.eu

40

Estateguru OÜ operates a leading European online marketplace platform specializing in short-term, property-backed business loans. The platform targets investors seeking secure investment opportunities backed by real estate mortgages across Europe. The company has an established market presence since 2013 and offers a digital investment service that connects businesses needing loans with investors. Technically, the website is built on WordPress using Elementor and Yoast SEO, hosted likely on SiteGround, and employs modern tracking and marketing tools such as Google Tag Manager and Intercom. The site is HTTPS secured with Cloudflare DNS but lacks DNSSEC and some security headers, indicating room for security enhancements. Privacy compliance is weak due to the absence of explicit privacy and cookie policies, and no direct contact information or incident response details are provided. Overall, the website is professional and trustworthy but would benefit from improved privacy and security disclosures to enhance compliance and user trust.

C

ChangeGroup

changegroup.com

74

ChangeGroup is a well-established global leader in currency exchange and related financial services, operating over 100 bureaus across multiple continents. Owned by Prosegur, a publicly listed company, ChangeGroup offers a broad portfolio including currency exchange, money transfers, tax free refunds, and ATM networks, targeting international travelers and business clients. The website reflects a mature digital presence with a focus on user experience and accessibility. Technically, the site uses modern web technologies and appears to be built on a robust CMS platform, likely Adobe Experience Manager. Security posture is strong with HTTPS enforced and cookie consent implemented, though explicit security headers and policies could be improved. WHOIS data for the subdomain is unavailable, which is expected and not suspicious. Overall, the site demonstrates professionalism, trustworthiness, and compliance with privacy regulations.

B

Bilendo

bilendo.de

76

Bilendo is a German-based SaaS company specializing in Accounts Receivable (AR) Automation and Credit Management software. Their platform integrates cloud-based tools to automate debtor management and order-to-cash processes, targeting finance executives, credit managers, accountants, sales, and IT professionals. The company positions itself as a modern, efficient solution provider with a strong client base including notable enterprises and industry references from BCG, PWC, and EOS. Their business model revolves around subscription-based cloud software with modular products such as Cloud Platform, Receivables, Risk, and Add-Ons. Technically, Bilendo leverages a modern tech stack including Ruby on Rails, Bootstrap 5, Font Awesome, and is hosted on AWS with Cloudflare providing firewall and CDN services. The website is well-optimized for performance, mobile responsiveness, and accessibility, reflecting a high level of digital maturity.

N

Nyenburgh Holding B.V.

nyenburgh.com

50

Nyenburgh Holding B.V. is a Dutch licensed proprietary trading firm specializing in providing liquidity to global financial markets through proprietary and arbitrage trading strategies. The company operates with a robust infrastructure co-located in major financial hubs including New York, Frankfurt, Milan Bergamo, and London, ensuring low-latency access and data for professional traders. Regulated by the Netherlands Authority for Financial Markets (AFM) and the Dutch Central Bank (DNB), Nyenburgh emphasizes risk management and operates solely with its own capital, not involving client funds. Technically, the website is built on WordPress using the Enfold theme, incorporating modern web technologies such as jQuery and YouTube iframe API. The site is mobile-optimized with good SEO practices and includes a comprehensive cookie consent mechanism compliant with GDPR. However, no explicit security headers were detected, and no direct contact emails or phone numbers are publicly listed, with contact primarily via a web form. From a security perspective, the site enforces HTTPS and implements cookie consent, but lacks visible advanced security policies or incident response information. The WHOIS data is unavailable, which limits domain trust verification, though the website content and regulatory references support legitimacy. Overall, the site presents a professional and trustworthy front with room for improvement in security transparency and contact information availability. Strategically, Nyenburgh should enhance its security posture by implementing recommended HTTP security headers, publishing incident response contacts, and considering a security.txt file. Improving accessibility and providing clearer direct contact details would also strengthen user trust and compliance. These steps will help maintain its market position as a reputable and secure proprietary trading firm.

X

xChange AS

changeinvest.com

72

Change Invest operates as a fintech investment platform offering a unified app for investing in cryptocurrencies, trading stocks, indices, commodities, and CFDs with leverage. The company targets retail investors primarily within the European Economic Area, emphasizing low fees, fast deposits, and regulatory compliance under Estonian and Dutch authorities. The platform boasts over 125,000 verified users and a broad asset offering, positioning itself as a competitive player in the EU fintech market. Technically, the website is built on Webflow CMS and integrates modern analytics and marketing tools such as Google Tag Manager, Facebook Pixel, Segment Analytics, and Adjust SDK. The site is mobile-optimized, fast-loading, and well-structured, providing an excellent user experience. However, some security best practices like explicit security headers are missing, and no incident response or vulnerability disclosure information is publicly available. From a security perspective, the platform enforces HTTPS, uses cold wallets for crypto custody, and provides public proof of reserves, indicating a mature security posture. Cookie consent mechanisms are implemented with opt-in features, supporting GDPR compliance. The absence of WHOIS registration data is a notable concern, potentially indicating privacy protection or data unavailability, which slightly reduces trustworthiness. Overall, Change Invest presents a professional, secure, and compliant fintech service with strong market positioning in the EU. Strategic improvements in transparency around security policies and WHOIS data would enhance trust and compliance further.

R

Rephop

rephop.com

74

Rephop is a specialized SaaS provider offering web-based group consolidation, reporting, and planning software tailored for CFOs and finance professionals. Established in 2013, it has positioned itself as a trusted solution for simplifying complex financial consolidation processes across multiple subsidiaries and currencies. The platform emphasizes ease of use, powerful features such as intergroup transaction reconciliation, non-controlling interest calculations, and compliance with IFRS and US GAAP standards. Its market presence is supported by customer testimonials and a clear pricing model targeting small to medium-sized businesses and enterprises. Technically, Rephop leverages modern web technologies including Next.js and React, hosted on Vercel with Cloudflare DNS services. The website is well-optimized for performance, mobile responsiveness, and accessibility, reflecting a mature digital infrastructure. Analytics tools such as Vercel Analytics and Google Tag Manager are used for user behavior tracking, though privacy compliance could be enhanced with explicit cookie consent mechanisms. From a security perspective, the site enforces HTTPS and uses domain transfer protection, but lacks DNSSEC and explicit security or incident response policies. No critical vulnerabilities or exposed sensitive data were detected. The WHOIS data confirms a consistent and legitimate domain registration history aligned with the company's operational timeline. Overall, Rephop demonstrates a strong business and technical foundation with room for improvement in privacy compliance and security transparency. Strategic recommendations include implementing cookie consent, publishing security policies, and enabling DNSSEC to bolster trust and regulatory adherence.

P

PZU Kindlustus

pzu.ee

67

PZU Kindlustus operates as an established insurance provider in Estonia, offering a range of personal insurance products including vehicle, travel, home, and accident insurance. The website reflects a professional presence with consistent branding and a focus on serving private individuals. The business is supported by a domain registered since 2012 under ALMIC OÜ, an Estonian registrar, indicating a stable and legitimate operation. Technically, the site is built on WordPress, leveraging modern tools such as Google Tag Manager, Cookiebot for cookie consent, and Cloudflare for DNS and security, demonstrating a mature digital infrastructure. Security measures include HTTPS enforcement and reCAPTCHA integration, though explicit security policies and headers could be enhanced. Privacy compliance is partially addressed via cookie consent, but the absence of a clear privacy policy and terms of service pages represents a compliance gap. Overall, the site is functional and trustworthy but would benefit from improved transparency and security documentation.

R

Register OÜ

ir.ee

62

Register OÜ operates the Inforegister website, a platform providing credit ratings, beneficial ownership information, financial forecasts, and business risk assessments primarily targeting Estonian businesses and individuals. The company positions itself as a trusted local provider of business and financial data services, leveraging a subscription-based model to deliver valuable insights. The website supports multiple languages and offers a user-friendly search interface to access company and individual data. Technically, the site is built on WordPress with modern integrations such as Google Site Kit for analytics and OAuth for authentication, indicating a moderate level of digital maturity. The site is mobile-optimized and employs HTTPS with a valid SSL certificate, ensuring secure communications. Security posture is solid with cookie consent mechanisms and no visible vulnerabilities, although there is room for improvement in publishing explicit security policies and incident response contacts. Overall, the website demonstrates a professional and trustworthy online presence with good compliance to privacy regulations and a clear business focus.

L

LandCredit AS

landcredit.ee

44

LandCredit AS is an Estonian financial services company specializing in loans secured by agricultural and forestry land. Their website targets farmers, forestry businesses, and renewable energy project developers, offering flexible loan products with faster processing times than traditional banks. The company positions itself as a niche lender contributing to rural development in Estonia. Technically, the website is built on WordPress with Elementor, leveraging modern analytics and marketing tools such as Google Analytics, Hotjar, and CookieYes for GDPR compliance. The site is well-structured, mobile-optimized, and provides clear contact channels and customer testimonials, enhancing trust and user experience. Security posture is solid with HTTPS and secure form handling, though improvements are recommended in publishing explicit security policies and incident response contacts. Overall, the website demonstrates a mature digital presence with good compliance and business credibility.

T

TaxScouts

taxscouts.com

72

TaxScouts is an established UK-based online tax return service founded in 2017, specializing in simplifying Self Assessment tax returns by pairing customers with accredited accountants. The company positions itself as a fast, affordable, and fully online solution targeting UK taxpayers who require assistance with personal and company tax filings. The website demonstrates a professional and consistent brand presence with clear service offerings and trust signals such as embedded Trustpilot reviews. Technically, the site is built on WordPress, leveraging modern analytics and marketing tools including PostHog, Google Tag Manager, and Microsoft Clarity, with Cloudflare DNS and NameCheap as registrar. The site is mobile optimized and SEO friendly, though accessibility features are basic. Security posture is good with HTTPS enabled and domain transfer protection, but could be improved by enabling DNSSEC and publishing explicit security policies or vulnerability disclosures. Privacy compliance is well addressed with a comprehensive cookie consent mechanism and GDPR-aligned cookie policy. However, explicit privacy policy and terms of service pages are not clearly found in the provided content. Overall, the domain registration data aligns well with the business claims, supporting legitimacy and trustworthiness.

C

Colombo Stock Exchange

cse.lk

72

The Colombo Stock Exchange (CSE) is the primary stock exchange in Sri Lanka, serving as a critical financial market infrastructure provider. The website offers comprehensive information on equity and debt trading, market disclosures, financial reports, and investor education. It targets investors, listed companies, and financial professionals within Sri Lanka and the broader financial community interested in Sri Lankan markets. The CSE holds a significant market position as the national stock exchange, facilitating capital market activities and supporting economic growth.

Dun & Bradstreet is a globally recognized enterprise specializing in business data and analytics, offering services that help companies achieve sales and marketing goals, navigate supply chains, and reduce credit risk. The website content is professionally presented in Estonian, targeting business customers in Estonia and potentially broader markets. The company leverages a mature digital infrastructure including Adobe Experience Manager CMS and advanced analytics tools such as Google Tag Manager and Adobe Helix RUM, indicating a high level of digital maturity. Security posture is solid with HTTPS enforced and a comprehensive cookie consent mechanism via TrustArc, though explicit security headers and incident response information are absent. Overall, the website reflects a trustworthy and professional business presence with room for improvement in transparency and security disclosures.

T

TBC Bank

tbcbank.ge

58

TBC Bank is a leading financial institution in Georgia, operating since 2000. The website serves as a digital portal for banking services targeting retail and corporate customers. The site is built as a modern Angular single-page application hosted on AWS infrastructure, integrating multiple analytics and marketing tools such as Google Analytics, Google Tag Manager, Visual Website Optimizer, and Zendesk Chat. While the technical implementation is modern and performant with good mobile optimization, the site lacks visible privacy and terms of service policies, as well as explicit contact information, which are critical for user trust and regulatory compliance. Security posture is moderate with HTTPS implied but no explicit security headers detected in the provided data. The domain WHOIS data is consistent with a legitimate, long-established Georgian bank, using privacy protection appropriately. Overall, the website is professional but could improve transparency and compliance documentation.

S

SmartCredit.io

smartcredit.io

69

SmartCredit.io operates as a decentralized finance (DeFi) lending marketplace that connects borrowers and lenders globally without intermediaries. The platform offers fixed-term, fixed-interest loans and personal fixed income funds, leveraging blockchain technology and AI-driven features to optimize lending and borrowing. It targets cryptocurrency users and investors seeking decentralized financial services, positioning itself as a niche player in the DeFi lending sector with a medium-sized user base and active engagement through social media and blog content. The business was founded in 2017 and operates primarily in the US market. Technically, the website is built on modern frameworks such as Angular and integrates analytics and marketing tools like Mixpanel, Google Tag Manager, and AdRoll. Hosting is provided via AWS infrastructure, ensuring reliable performance and scalability. Security posture is solid with HTTPS enforced and no exposed sensitive data, though the absence of explicit security policies, incident response contacts, and security headers suggests room for improvement. Privacy compliance is well addressed with comprehensive privacy and cookie policies and GDPR adherence. Overall, the platform demonstrates a good balance of technical maturity, business credibility, and user experience, though enhancing security transparency and incident readiness would strengthen trust further.

R

Ridge Capital

ridgecap.eu

49

Ridge Capital AS is a small Estonian investment firm founded in 2010, specializing in active investing focused on emerging markets, particularly in Central and Eastern Europe, South Eastern Europe, and the Baltic countries. The company leverages over 25 years of team experience to pursue event driven trading and long-term value investments, maintaining portfolio liquidity through diverse financial instruments. The website reflects a professional and consistent brand presence with clear business descriptions and contact information, targeting investors interested in niche emerging markets. Technically, the website is built on WordPress using Elementor and enhanced with Yoast SEO and Weglot for multilingual support. The site is mobile optimized with good SEO practices and moderate performance. Security posture is solid with HTTPS enforced and cookie consent implemented, though it lacks advanced security headers and explicit security or incident response policies. No forms collecting personal data are present on the homepage, reducing immediate data protection concerns. Overall, the website demonstrates a mature digital presence with good privacy compliance and business credibility. Security practices are adequate but could be improved by adding security headers, incident response contacts, and vulnerability disclosure mechanisms. The domain registration is consistent with the business history and shows no suspicious indicators, supporting the legitimacy of the entity. Strategic recommendations include enhancing security headers, publishing a security policy, providing incident response contact details, and considering a vulnerability disclosure program to strengthen trust and compliance.

S

Strands

strands.com

84

Strands is a well-established fintech company specializing in digital banking software solutions that leverage real-time data and AI to enhance customer engagement and financial management. Their platform targets financial institutions, banks, and SMEs, offering modular solutions such as Personal Financial Management, Business Financial Management, AI-driven insights, and Carbon Footprint analytics. The company demonstrates a strong market position with a global client base and a consistent brand presence. Technically, the website is built on WordPress with modern marketing and analytics integrations, including HubSpot, Google reCAPTCHA Enterprise, Matomo, and LinkedIn Insight. The site is well-optimized for SEO, mobile responsiveness, and user experience. Security posture is solid with HTTPS enforcement and bot protection, though DNSSEC is not enabled and explicit security policies are not published. Overall, the domain registration is consistent with the business claims, showing legitimacy and transparency. The website exhibits extensive user tracking balanced with privacy compliance mechanisms such as cookie consent banners and GDPR-aligned policies.

E

eHost OÜ

aksohaus.ee

40

Investor.ee is a small Estonian educational website focused on providing practical advice and information about investing, portfolio management, risk management, and financial knowledge. The site targets individuals and organizations interested in growing their capital through various investment strategies. The business operates primarily as a content and informational platform, with a niche focus on the Estonian-speaking investment community. The domain is registered to eHost OÜ since 2019, consistent with the website's scope and scale. Technically, the website is built on WordPress using a modern theme and standard libraries such as Bootstrap, jQuery, and FontAwesome. It integrates Google Tag Manager for analytics and Google reCAPTCHA v3 for spam protection on forms. The site is hosted behind Cloudflare DNS and uses HTTPS, ensuring secure communication. Mobile optimization and SEO practices are good, though accessibility features are basic. From a security perspective, the site enforces HTTPS and uses reCAPTCHA to protect forms. However, it lacks explicit security headers like Content-Security-Policy and X-Frame-Options, and does not publish privacy or cookie policies, which are critical for GDPR compliance. No incident response or security policy information is available. External links are configured to open in new windows with noopener for security. Overall, the website is functional, professionally designed, and provides relevant content for its audience. The main risks relate to privacy compliance gaps and missing security headers. Strategic improvements in these areas would enhance trust and regulatory adherence.

A

Ambient Sound Investments

asi.ee

46

Ambient Sound Investments (ASI) is a private asset management firm established in 2003 by four founding engineers of Skype. The company operates as a family office with a focus on investments across venture capital, private equity, listed equity, and real assets, with assets geographically located in Europe, the US, and Asia. The website presents a professional image with clear navigation and relevant business content, targeting investors and professionals interested in diversified asset management. The business model is niche and specialized, leveraging the founders' technology and finance backgrounds. Technically, the website is built on the Voog CMS platform, utilizing standard web technologies such as JavaScript, CSS, and HTML5. The site is mobile optimized and performs moderately well, though accessibility features are basic. The hosting and domain registration are consistent with the business location in Estonia, with no signs of privacy protection or suspicious WHOIS data. External scripts are limited and primarily related to the CMS platform. From a security perspective, the website benefits from HTTPS with a valid SSL certificate, but lacks important security headers and visible security policies. There are no privacy or cookie policies, nor contact information for security incidents or data protection officers. No vulnerabilities or exposed sensitive data were detected, but the absence of key compliance documents and security headers represents a moderate risk. Overall, the website is functional and professional but would benefit from enhanced privacy compliance, improved security headers, and clearer contact information to strengthen trust and regulatory adherence.

F

FM Capital Consulting Ltd.

capital-consulting.com

48

FM Capital Consulting Ltd. is a well-established Estonian finance consulting firm specializing in worldwide company registration, bookkeeping, compliance, legal support, and tax planning services. The company targets businesses and entrepreneurs, including startups and fintech companies, offering tailored corporate and tax advantage solutions. Their market position is that of a niche consulting provider with expertise in cross-border transactions and fintech licensing. The website is professionally designed with good content quality and clear navigation, supporting their business credibility. Technically, the website is built on WordPress with common plugins such as Yoast SEO, Slider Revolution, and WPBakery Page Builder. It uses modern tracking and analytics tools including Google Analytics and LinkedIn Insight Tag. Performance and mobile optimization are good, though accessibility is basic. The hosting provider is not explicitly identified but the domain is registered with GoDaddy and uses DNS servers from zone.eu and zone.ee. From a security perspective, the site uses HTTPS with a good SSL configuration but lacks DNSSEC and explicit security headers. No privacy or cookie policies are present, which is a compliance gap especially given the use of tracking technologies. Contact information is clearly provided, enhancing trust. No WAF or blocking mechanisms are detected, allowing full content access. Overall, the website presents a moderate risk profile with strengths in business credibility and technical implementation but weaknesses in privacy compliance and security best practices. Strategic improvements in privacy policy implementation, cookie consent, and security headers would enhance their security posture and compliance standing.

I

Iutecredit

iutecredit.md

62

Iutecredit is a Moldovan financial services company specializing in instant credit products, refinancing, and smart shopping solutions. The company leverages a mobile application (Myiute) and an extensive ATM network to provide convenient access to financial services. The website reflects a mature digital presence with a focus on user experience and mobile accessibility. The business is positioned as a trusted player in the Moldovan microfinance sector with over 15 years of operational history through its parent company, Iute Group AS. Technically, the website is built on WordPress and integrates multiple analytics and marketing tools, indicating a well-developed digital marketing strategy. Security posture is strong with HTTPS, security headers, and reCAPTCHA usage, though some improvements in cookie consent and incident response transparency are recommended. Overall, the domain registration data aligns well with the business claims, supporting legitimacy and trustworthiness.

I

Inzmo Gmbh

inzmo.com

72

INZMO GmbH is a German-based innovative insurance provider specializing in digital insurance solutions for consumers. Their offerings include mobile phone insurance, rental deposit warranties, bicycle insurance, laptop/tablet insurance, and e-scooter insurance. The company positions itself as a revolutionary player in the insurance market, emphasizing ease of use, fast claims processing, and 24/7 customer support. Their market approach leverages a user-friendly app and digital-first experience to attract tech-savvy customers seeking hassle-free insurance products. Technically, the website is built on modern frameworks such as Next.js and React, hosted on AWS infrastructure, and integrates Google Tag Manager and Cookiebot for analytics and privacy compliance. Security posture is strong with HTTPS enforcement and bot protection via Google reCAPTCHA, though some security headers could be improved. Privacy and cookie policies are comprehensive and GDPR compliant, supporting trust and regulatory adherence. Overall, INZMO demonstrates a mature digital presence with a solid business model and good security hygiene.

AuditPartner is a small Estonian auditing and financial consulting firm with a website primarily in Estonian and an English language option. The company positions itself as a professional service provider focusing on seeing beyond the numbers, targeting businesses requiring auditing and financial services. The website is built on WordPress with common web technologies such as jQuery and Bootstrap, indicating a standard but modern technical infrastructure. Performance and mobile optimization are moderate to good, with basic SEO and accessibility features. From a security perspective, the site uses HTTPS with good SSL configuration but lacks important security headers and visible security policies such as privacy, cookie, or incident response policies. No vulnerability disclosure or security.txt files are present, and no contact information such as emails or phone numbers are explicitly provided on the homepage. These gaps reduce the overall privacy compliance and security posture scores. Overall, the website is functional and professionally designed but lacks critical compliance and security transparency elements. The domain WHOIS data is consistent with the business claims, supporting legitimacy. Strategic improvements in privacy policy publication, security headers, and contact transparency would enhance trust and compliance.

Berbank AS operates as a small Estonian financial institution providing traditional banking services including private and business banking, loans, deposits, and internet banking. The website targets Estonian private individuals and business clients, offering localized financial products. The domain is registered since 2019, consistent with a relatively new or niche bank. The technical infrastructure is basic, relying on jQuery and Google Analytics, with no modern frameworks or CMS detected. The website lacks HTTPS enforcement and security headers, which are critical for banking sites, indicating a weak security posture. Privacy compliance is poor, with no visible privacy or cookie policies, and no GDPR compliance indicators. Contact information is present but limited, and no incident response or security policy details are provided. Overall, the site shows moderate business credibility but requires significant improvements in security and privacy to meet industry standards.

T

TF Bank

tfbankgroup.com

66

TF Bank operates as an internet-based niche bank offering consumer banking services through a proprietary IT platform emphasizing automation. The website presents a professional image consistent with a financial institution targeting consumers seeking streamlined online banking solutions. The technical infrastructure is built on WordPress CMS, utilizing modern web technologies such as jQuery and Cookiebot for cookie consent management, alongside Google Tag Manager for analytics. The site is secured with HTTPS, and cookie consent is actively managed, reflecting a commitment to privacy compliance. However, the absence of WHOIS data for the domain group.tfbank.se raises questions about domain registration legitimacy, although the website content itself appears credible and well-maintained. Security posture is solid with HTTPS and consent mechanisms, but could be improved by adding explicit security headers and detailed privacy and security policies. Overall, the site demonstrates a good balance of professionalism, technical maturity, and privacy awareness, with room for enhanced transparency and security documentation.

A

askRobin México

askrobin.com

57

askRobin México operates as an online loan search platform targeting Mexican consumers seeking personal loans and debt liquidation options. The platform aggregates offers from multiple financial institutions to provide tailored financing proposals. The website is built on WordPress with a modern tech stack including jQuery, Bootstrap Slider, and integrates marketing and tracking tools such as Google Tag Manager, Facebook Pixel, and SalesManago. The site is well-structured, mobile-optimized, and provides clear navigation and content relevant to its audience. Security posture is adequate with HTTPS enforced, but lacks some security headers and cookie consent mechanisms. WHOIS data for the subdomain is unavailable, which slightly impacts trust but the presence of partner logos and privacy policies supports legitimacy. Overall, the site presents a professional and functional digital presence for its business model.

T

Tickmill Europe Ltd

tickmill.com

69

Tickmill Europe Ltd operates as a regulated online forex and CFD broker targeting European clients. The company offers a range of trading instruments including forex, cryptocurrencies, stocks, indices, bonds, and commodities through popular platforms such as MetaTrader 4 and 5. The website demonstrates a strong market position with emphasis on low spreads, fast execution, and comprehensive client support. The digital infrastructure leverages modern technologies including Google Analytics, HubSpot, and Cloudflare, ensuring robust performance and user experience. Security posture is solid with HTTPS enforcement, bot management, and cookie consent mechanisms, although explicit security headers and incident response contacts could be enhanced. The absence of WHOIS domain registration data introduces some uncertainty in domain legitimacy, but the professional presentation and regulatory references mitigate this concern. Overall, the website is well-designed, compliant with GDPR, and employs extensive analytics and advertising tools to support its business model.

S

Salva Kindlustuse AS

salva.ee

54

Salva Kindlustuse AS is an established Estonian insurance company founded in 1993, offering a range of insurance products to the local market. The website reflects a mature business with consistent branding and a focus on providing insurance services to Estonian customers. The technical infrastructure is modern, leveraging React and Material-UI frameworks, integrated with Google Tag Manager for analytics and Apple MapKit for mapping services. The presence of a chat widget indicates customer engagement capabilities. Security posture is strong with HTTPS enforced and appropriate security headers, though explicit privacy and terms of service documentation are missing, which impacts compliance confidence. Overall, the website is professional and trustworthy, with room for improvement in privacy transparency and contact information clarity.

E

Eaton Group

eatongroup.com

63

Eaton Group is a financial services company specializing in advancing creditor rights and debt collection. The company emphasizes ethical business practices and transparent consumer guidance to help resolve outstanding debt obligations. Their market position is that of an established creditor rights service provider targeting creditors and consumers within the financial services sector. The website is built on WordPress using a professional theme and SEO plugin, indicating a moderate level of digital maturity. However, Google Analytics is present but not configured, and no social media presence is evident. Security posture is generally good with HTTPS enforced and no visible vulnerabilities, but the absence of security headers and privacy policies indicates room for improvement. The lack of WHOIS data reduces domain trustworthiness, though the website content and contact information appear legitimate. Overall, the site is functional and professional but would benefit from enhanced privacy compliance and security best practices.

TIIB Kindlustusmaakler OÜ is an Estonian insurance brokerage firm established in 2010, offering various insurance products such as traffic, casco, home, and property insurance. The company maintains a basic but functional website providing essential business and contact information, including financial reports and legal documents, which supports its credibility in the local market. The website targets Estonian customers seeking insurance brokerage services and positions itself as a trusted local player in the finance sector. From a technical perspective, the website is built using basic HTML and CSS without modern frameworks or CMS detected. The site lacks mobile optimization and advanced accessibility features, indicating a need for modernization. No analytics or tracking technologies are present, suggesting minimal user data collection. Hosting and domain registration are stable and consistent with the business profile, registered through Telia Eesti AS. Security posture is weak due to the absence of visible HTTPS confirmation, security headers, privacy and cookie policies, and incident response information. No forms or interactive elements are present, reducing attack surface but also limiting user engagement. The lack of GDPR compliance indicators and cookie consent mechanisms poses regulatory risks. Overall, the site is functional but requires significant improvements in security, privacy compliance, and technical modernization to enhance trust and user experience.

E

Eesti Kindlustusmaaklerite Liit

ekml.ee

42

Eesti Kindlustusmaaklerite Liit is a professional association representing leading insurance brokers in Estonia. The organization acts as a liaison between its members and the government, particularly in regulatory matters, providing a unified voice for the insurance brokerage sector. The website serves as an information hub for members and clients seeking insurance brokerage services, offering news, member contacts, and membership information. The site is built on WordPress with modern plugins and SEO optimizations, reflecting a moderate to good level of digital maturity. Security measures include HTTPS and Google reCAPTCHA on forms, but lack explicit security headers and incident response information. Privacy compliance is partial, with a privacy policy present but no cookie consent mechanism. Overall, the site is professional and trustworthy, suitable for its niche audience.

E

EveryPay

every-pay.com

54

EveryPay operates as a payment gateway service provider offering a merchant portal and risk management tools to facilitate real-time transaction tracking, refunds, and fraud prevention. The website targets merchants and e-commerce businesses primarily in Estonia and the Baltic region, supporting multiple languages including English, Estonian, Latvian, and Lithuanian. The company positions itself as a reliable regional payment service provider with a focus on merchant support and integration ease. Technically, the website is built on WordPress with modern plugins such as Yoast SEO and WPML for multilingual support. It uses Uikit for styling and includes Google Analytics and Tag Manager for tracking. The site is mobile optimized and has good SEO practices, though accessibility features are basic. Performance is moderate with no major technical issues detected. From a security perspective, the site enforces HTTPS and uses secure forms with nonce tokens. However, it lacks visible security headers and explicit privacy or cookie policies, which are areas for improvement. No vulnerabilities or exposed sensitive data were found. The WHOIS data for the subdomain is unavailable, which is typical and not suspicious. Contact information is clearly provided, enhancing trust. Overall, the website demonstrates a solid business and technical foundation with moderate security posture. Strategic improvements in privacy compliance and security headers would enhance trust and compliance. The site is suitable for its target audience but could benefit from enhanced transparency and security best practices.