Security Directory

E

Europa Cinemas

europa-cinemas.org

61

Europa Cinemas is a well-established European cinema network founded in 1992, supported by the European MEDIA Programme and CNC. It serves as a key platform for the circulation and diversity of European films, uniting over 1,200 cinemas across 39 countries. The website reflects a professional and consistent brand presence, targeting cinema operators and film professionals with services including funding, training, and collaborative projects. Technically, the site employs modern web technologies and includes a GDPR-compliant cookie consent mechanism, though some security headers are missing. The security posture is adequate but could be improved with additional headers and policies. WHOIS data is incomplete, which slightly impacts domain trust but is mitigated by the site's content and partner affiliations. Overall, the site is accessible, well-structured, and trustworthy, with room for technical and security enhancements.

D

Dune

dunetechnology.com

56

Dune Technology is a Spanish IT consulting company established in 2011, offering tailored technology solutions primarily to SMEs and larger enterprises. Their services include private cloud infrastructure, cybersecurity audits, network solutions, IT equipment sales and rentals, and comprehensive IT consulting and service desk support. The company positions itself as a trusted technology partner with a focus on innovation and client success. Technically, the website is built on WordPress with Elementor and Yoast SEO, showing moderate performance and good mobile optimization. Security posture is adequate with HTTPS enabled and domain status protections, but lacks DNSSEC and explicit security headers. Privacy compliance is partial, with a cookie consent mechanism but no visible privacy or terms of service pages. Business credibility is supported by consistent branding, testimonials, and a domain age matching the company's history. Overall, the website is professional and functional but could improve in privacy transparency and security best practices.

E

Ecoembes

ecoembesempleo.es

68

Ecoembesempleo.es is a professional website dedicated to providing employment offers and HR news related to Ecoembes, a company focused on environmental and recycling initiatives. The site targets job seekers interested in careers within Ecoembes and related green enterprises. The business model centers on career development and information dissemination rather than direct commercial transactions. The website is built on WordPress and integrates common marketing and analytics tools such as Google Tag Manager, Google Analytics, Twitter Pixel, and Cookiebot for cookie consent management. The technical infrastructure is modern and mobile-optimized, providing a good user experience with clear navigation and relevant content. Security posture is solid with HTTPS enforced and a cookie consent mechanism in place, although the absence of explicit security headers and privacy policy pages suggests room for improvement. The lack of accessible WHOIS data limits the ability to fully verify domain registration legitimacy, which slightly reduces overall trust. Strategic recommendations include enhancing security headers, publishing comprehensive privacy and security policies, and improving transparency around data protection and incident response.

Seneca is a Dutch technology company specializing in modular web applications for digital customer engagement, including websites, intranet, online forms, enterprise search, and knowledge management. The company is positioned as a trusted provider with ISO 27001 certification and compliance with DigiD security assessments, indicating a strong commitment to information security. Their partnership with Decos further strengthens their market position. The website is professionally designed, mobile-optimized, and provides clear contact and privacy information, reflecting a mature digital presence. Technically, the website uses modern frameworks such as Bootstrap and jQuery, with Matomo analytics for privacy-conscious user tracking. The CMS appears custom or proprietary (Smartsite). Performance and accessibility are good, though some security headers are not explicitly detected, representing an opportunity for enhancement. The site enforces HTTPS and implements cookie consent mechanisms, supporting GDPR compliance. Security posture is strong with certifications and no visible vulnerabilities or exposed sensitive data. However, the absence of an incident response page or vulnerability disclosure policy suggests room for improvement in transparency and readiness. Overall, the website and business demonstrate a high level of professionalism and trustworthiness, suitable for their target market. Strategic recommendations include implementing security headers, publishing incident response and vulnerability disclosure information, and adding Terms of Service to enhance legal clarity and user trust.

K

Kadaster

pdok.nl

74

PDOK is a Dutch government platform operated by Kadaster that provides high-quality, open geo-data accessible via web services, APIs, and downloads. It serves government agencies, developers, and the public with a comprehensive catalog of geo-datasets and interactive viewers. The platform is well-established, leveraging modern web technologies such as Liferay, React, and Piwik PRO analytics, ensuring a robust and user-friendly experience. Security posture is strong with HTTPS, CSP nonce usage, and secure form handling, though explicit security policies and incident response contacts are not publicly disclosed. Privacy compliance is good, with clear cookie and privacy policies and consent mechanisms. Overall, PDOK demonstrates a mature digital presence with high trustworthiness and professional content.

B

BEL gemeenten

werkenvoorbel.nl

54

BEL gemeenten operates a regional municipal recruitment website serving the municipalities of Blaricum, Eemnes, and Laren in the Netherlands. The site provides job vacancy listings, application forms, and information about the municipalities, targeting job seekers interested in public sector employment. The platform is built on WordPress with a modern theme and plugins, including interactive job search filters and video content, reflecting a medium-sized municipal digital presence launched in 2023. Technically, the site uses standard web technologies such as PHP, jQuery, Google Tag Manager, and Google Analytics, with good mobile optimization and SEO practices. Security posture is adequate with HTTPS enabled and no exposed sensitive data, but lacks DNSSEC and explicit security headers. Privacy compliance is limited due to missing privacy and cookie policies and no visible consent mechanism. Overall, the website is professional and trustworthy but would benefit from enhanced privacy and security disclosures.

T

Tolkcontact

tolkopafstand.nl

54

Tolkcontact is a Dutch organization specializing in providing communication accessibility services for deaf and hard of hearing individuals. Their offerings include sign language interpreting both remotely and on-site, translation services, livestreaming for events, and a dedicated app for on-demand interpreting. The company operates under the parent organization Berengroep, positioning itself as a key player in accessibility services within the Netherlands. The website reflects a professional and user-friendly design with clear navigation and relevant content tailored to their target audience. Technically, the site is built on WordPress with modern plugins and frameworks, ensuring good performance and SEO optimization. Security posture is solid with HTTPS enforced and no visible vulnerabilities, although some security policies and cookie consent mechanisms are absent. Overall, the site demonstrates a high level of business credibility and technical maturity, with room for improvement in privacy compliance and security transparency.

B

Brandweer Zeeland

brandweerzeeland.nl

71

Brandweer Zeeland is the official fire department service for the Zeeland region in the Netherlands, operating under the umbrella of Veiligheidsregio Zeeland. The organization manages 64 fire stations with approximately 1200 volunteers and professional staff, providing firefighting, safety education, and volunteer recruitment services. The website serves as a comprehensive information portal for residents, potential volunteers, and employers, offering details on fire safety, incident reporting, and career opportunities. The site is well-branded, consistent, and clearly targeted at the regional community and stakeholders. Technically, the website is built on Drupal 10, leveraging modern web technologies and integrating analytics and tracking tools such as Google Analytics, Facebook Pixel, and Hotjar. The site is mobile-optimized, accessible, and SEO-friendly, with good performance metrics. Security-wise, HTTPS is enforced, and the site includes a responsible disclosure page, indicating a proactive security posture. However, some security headers are missing, and no explicit security policy or security.txt file is published. Overall, the website demonstrates a strong security posture with no critical vulnerabilities detected, good privacy compliance with clear policies and consent mechanisms, and solid business credibility supported by consistent WHOIS data and official government affiliations. The site effectively balances public service transparency with user privacy and security. Strategic recommendations include enhancing security headers, publishing a security.txt file, and expanding security policy documentation to further strengthen trust and compliance.

M

Mijn Kinddossier

mijnkinddossier.nl

48

Mijn Kinddossier is a Dutch healthcare digital portal focused on providing parents access to their children's health data and youth healthcare services. The platform offers functionalities such as questionnaire completion, personalized advice, growth tracking, appointment scheduling, and vaccination record viewing. It integrates DigiD authentication, a trusted Dutch government identity system, enhancing user trust and security. The website is well-branded and targets Dutch parents and youth healthcare organizations, positioning itself as a specialized service in the healthcare sector. Technically, the website uses a modern JavaScript stack including jQuery, jQuery UI, Pickadate, Slick Carousel, Popper.js, Tippy.js, Cropper.js, and Modernizr, built on the Wicket Java web framework. The site is moderately optimized for performance and mobile devices, with a good user experience and clear navigation. However, no CMS or hosting provider information is evident, and SEO and accessibility features are basic. From a security perspective, the site uses HTTPS and DigiD authentication, which are positive indicators. A responsible disclosure link is present, showing some security awareness. However, no privacy or cookie policies are found, no contact information is provided, and no security headers are detected, which are gaps in compliance and security best practices. The use of Sentry indicates error tracking but no extensive analytics or tracking is observed. Overall, the website is functional and professional but would benefit from improved privacy compliance, explicit security policies, and enhanced transparency. Strategic recommendations include publishing privacy and cookie policies, implementing security headers, and providing clear contact and incident response information to strengthen trust and compliance.

N

Nemzetközi Gyermekmentő Szolgálat

saferinternet.hu

49

The website saferinternet.hu represents a Hungarian non-profit organization dedicated to promoting safer internet usage among children, parents, and educators. It operates as a national safer internet center with strong ties to European Union initiatives and partnerships with recognized organizations such as the Nemzetközi Gyermekmentő Szolgálat. The site offers educational content, awareness campaigns, and events aimed at fostering conscious and confident online behavior among children. The business model is focused on non-profit educational services with a medium organizational size and a founding year of 2019. Technically, the website employs a modern technology stack including Aurelia and React frameworks, alongside popular libraries like jQuery and Chart.js. The site demonstrates good mobile optimization, accessibility, and SEO practices, with moderate performance. The CMS appears custom or proprietary, and no hosting provider details were identified. The site uses advanced front-end technologies and animations to enhance user experience. From a security perspective, the site enforces HTTPS with excellent SSL configuration and includes CSRF tokens and reCAPTCHA v2 for form security. However, it lacks explicit security headers and published security policies or incident response contacts. No vulnerabilities or exposed sensitive data were detected. Privacy compliance is strong, with clear cookie consent mechanisms and a comprehensive privacy policy aligned with GDPR requirements. Overall, the website is trustworthy and professional, with a high level of content quality and business credibility. Recommendations include implementing additional security headers, publishing a security policy and incident response contacts, and adding a vulnerability disclosure or security.txt file to enhance transparency and security posture.

M

Magyar Lovasterápia Szövetség Alapítvány

lovasterapia.hu

51

Magyar Lovasterápia Szövetség Alapítvány is a Hungarian non-profit organization dedicated to equine therapy, education, and community engagement through events and volunteer programs. The website reflects a well-established entity with a domain registered since 2002, indicating a stable presence in the therapeutic riding sector. Their services focus on training, therapy, and organizing events, targeting individuals interested in equine-assisted therapy and related activities. Technically, the website employs a modern tech stack including Aurelia framework, React, and various JavaScript libraries, managed via SystemJS. The site is built on the Ponte CMS platform, providing a structured and modular approach. Performance is moderate with good mobile optimization and basic accessibility features. SEO is basic but present through meta tags and Open Graph data. Security posture is adequate with HTTPS usage and CSRF tokens, though explicit security headers are not detected. Privacy compliance is supported by a visible cookie consent mechanism and a privacy policy page, indicating GDPR awareness. Contact information is clearly presented with multiple phone numbers and physical addresses, enhancing business credibility. Overall, the website is professional, trustworthy, and functional with room for improvement in security headers and detailed privacy disclosures. No blocking or WAF interference was detected, allowing full content access and analysis.

N

Nemzetközi Gyermekmentő Szolgálat Magyar Egyesület

gyermekmento.hu

49

Nemzetközi Gyermekmentő Szolgálat Magyar Egyesület is a well-established non-profit organization dedicated to supporting disadvantaged children in Hungary and internationally. Founded in 1988, the organization operates multiple programs aimed at improving the lives of physically and mentally disabled, orphaned, and socially disadvantaged children. Their activities include healthcare services, organizing charity events, and community outreach. The website reflects a professional and consistent brand with a focus on transparency and engagement through events and social media. Technically, the website employs modern JavaScript frameworks such as Aurelia and React, along with Bootstrap for responsive design. It uses Google Analytics and Google Tag Manager for tracking and performance monitoring. The site is hosted securely with HTTPS and includes CSRF tokens for form security. However, some security headers are not explicitly detected, and privacy compliance elements like privacy and cookie policies are missing. From a security perspective, the site demonstrates basic good practices but lacks comprehensive security policies and vulnerability disclosures. No WAF or blocking mechanisms are detected, and the domain's WHOIS data is consistent with the organization's history, supporting legitimacy. The absence of explicit contact emails and phone numbers in the analyzed content suggests these may be located on other pages. Overall, the website is credible and professionally maintained but would benefit from enhanced privacy compliance and security policy transparency to improve trust and regulatory adherence.

A

Astellas Pharma Inc.

astellas.com

70

Astellas Pharma Inc. is a globally recognized pharmaceutical company headquartered in Tokyo, Japan, focused on improving health worldwide through innovative pharmaceutical products and advanced research in regenerative medicine and immuno-oncology. The website reflects a mature enterprise with comprehensive content targeting healthcare professionals, investors, and partners, emphasizing transparency and sustainability. Technically, the site is built on Drupal 10, leveraging modern web technologies and standard security practices, including HTTPS and cookie consent mechanisms. Security posture is strong with appropriate headers and no visible vulnerabilities, though explicit security policies and incident response contacts are absent. The WHOIS data is notably missing, which is unusual for a company of this scale but likely due to registry or query limitations rather than malicious intent. Overall, the website demonstrates high professionalism, good privacy compliance, and solid business credibility.

G

Gazdasági Versenyhivatal

gvh.hu

65

The Gazdasági Versenyhivatal (GVH) website serves as the official online presence of the Hungarian Competition Authority, a government regulatory body established in 1993. The site provides comprehensive information and services related to competition law enforcement, consumer protection, and public education. It targets Hungarian businesses, consumers, legal professionals, and public authorities, offering key services such as document inspection booking, event information, and regulatory publications. The website is primarily in Hungarian with an English language option, reflecting its national focus. Technically, the website employs a modern technology stack including Aurelia and React frameworks, modular JavaScript loading via SystemJS, and various UI libraries such as Chart.js and Select2. The site demonstrates good mobile optimization, accessibility, and SEO practices, supported by structured navigation and consistent branding. Performance is moderate, with room for optimization. From a security perspective, the site enforces HTTPS, uses CSRF tokens, and implements secure login and password reset forms. While standard security headers are not explicitly confirmed, the site follows best practices in avoiding exposed sensitive data and using modern frameworks. Privacy and cookie policies are present and GDPR compliant, with consent-based loading of Google Analytics scripts. No critical vulnerabilities or suspicious content were detected. Overall, the GVH website presents a trustworthy, professional, and secure platform aligned with its government mandate. Strategic recommendations include enhancing security header implementation, publishing explicit security policies and incident response contacts, and maintaining up-to-date third-party libraries to sustain a strong security posture.

D

Diákhitel Központ

diakhitel.hu

65

Diákhitel Központ operates a well-established Hungarian website providing comprehensive information and services related to student loans, including interest-free and favorable loan options. The site targets students and their families, offering financial support tools and educational content to facilitate informed borrowing decisions. The business is positioned as a key player in Hungary's student finance sector, with a domain age of over 23 years supporting its legitimacy. Technically, the website is built on WordPress with the Avada theme and employs modern SEO and analytics tools such as Yoast SEO Premium, Google Analytics, and Facebook Pixel. Security posture is strong with HTTPS, security headers, and reCAPTCHA usage, although explicit security policies and incident response contacts are absent. Privacy compliance is well addressed with clear cookie consent mechanisms and a comprehensive privacy policy. Overall, the site demonstrates good professionalism, trustworthiness, and user experience, with room for improvement in accessibility and explicit security documentation.

B

Budapest Főváros II. Kerület Önkormányzata

masodikkerulet.hu

55

Budapest Főváros II. Kerület Önkormányzata operates as the official local government authority for the 2nd district of Budapest, Hungary. The website serves as a comprehensive portal for residents and stakeholders, providing news, public service information, community engagement opportunities, and administrative contacts. The site is well-branded, consistent, and targets local citizens with relevant municipal content. Technically, the site is built on Drupal CMS with modern frontend frameworks like Bootstrap and jQuery, supplemented by Google Analytics and Facebook SDK for analytics and social media integration. The website is mobile-optimized and accessible, with good SEO practices in place. Security posture is solid with HTTPS enforced and no visible vulnerabilities, though explicit security headers and a cookie consent mechanism are missing, representing areas for improvement. The domain is longstanding and registered consistently with the official municipal entity, enhancing trust and legitimacy. Overall, the site demonstrates a mature digital presence suitable for a government entity, though it could benefit from enhanced privacy compliance and security transparency.

M

MegazoneCloud

megazonecloud.com

55

MegazoneCloud is a leading AWS cloud managed service provider (MSP) based in Korea, established in 2012 as the first official AWS partner in the country. The company offers a comprehensive suite of cloud services including consulting, implementation, enterprise support, management, cost optimization, billing, managed security, and security consulting. Positioned as a premier tier AWS partner, MegazoneCloud commands a strong market presence with a large client base and significant annual revenue. The website reflects a professional digital presence with good content quality and consistent branding, targeting enterprise customers seeking cloud transformation and managed services. Technically, the website is built on WordPress with modern plugins and frameworks, including WPBakery Page Builder and Slider Revolution. It employs HTTPS with enforced redirection and integrates analytics tools such as Google Analytics and Facebook Pixel. Mobile optimization and SEO practices are good, though accessibility features are basic. Security posture is strengthened by multiple ISO certifications and ISMS compliance, though explicit security headers and incident response contacts are not evident. The WHOIS data is notably absent, which raises concerns about domain registration transparency. Despite this, the website's content and certifications suggest a legitimate and established business. Privacy and cookie policies are not explicitly found, indicating room for improvement in compliance. Overall, the site demonstrates a mature business with solid technical infrastructure but could enhance trust and compliance by addressing WHOIS transparency and privacy disclosures.

L

Lucentia Research Group

lucentia.es

59

Lucentia Research Group is an academic research entity affiliated with the University of Alicante, specializing in business intelligence, big data, artificial intelligence, and e-learning solutions. Established in 2008, the group has a strong national and international presence demonstrated by numerous high-impact publications and competitive project participation. Their services target both academic and business audiences, focusing on innovative data analytics and AI applications across multiple sectors including education, healthcare, and industry. Technically, the website is built on WordPress using modern plugins such as WPBakery Page Builder, Contact Form 7, and integrates Google services for fonts, analytics, and reCAPTCHA. The site is mobile-optimized with good SEO practices but lacks some advanced accessibility features and security headers. Security posture is solid with HTTPS enforced and spam protection via reCAPTCHA, but the absence of security headers and cookie consent mechanisms indicates room for improvement in compliance and defense-in-depth. The lack of WHOIS data due to query restrictions limits domain trust assessment but the website content and structure suggest legitimacy. Overall, the site is professional and trustworthy, serving as a credible platform for the research group. Strategic recommendations include implementing cookie consent, enhancing security headers, publishing security policies, and improving accessibility to strengthen compliance and user trust.

Gemeente Wijdemeren is the official municipal government website serving the Wijdemeren region in the Netherlands. It provides residents and visitors with essential public services information such as appointment scheduling, passport and ID services, driver's license processing, moving notifications, roadwork updates, and public announcements. The website targets local citizens and stakeholders, positioning itself as a trusted government authority with a clear focus on accessibility and user engagement. Technically, the site employs a modern tech stack including Bootstrap for responsive design, FontAwesome for icons, jQuery for scripting, Matomo for privacy-conscious analytics, and ReadSpeaker for accessibility enhancements. The site is mobile-optimized, well-structured, and SEO-friendly, though it appears to use a custom or proprietary CMS. Performance is moderate with good accessibility features. From a security perspective, the website enforces HTTPS and implements cookie consent mechanisms, reflecting good privacy compliance. However, it lacks visible security headers and does not publish explicit security policies or incident response contacts. No vulnerabilities or exposed sensitive data were detected. The WHOIS data confirms the domain's legitimacy and consistency with the municipality's identity. Overall, the website demonstrates a solid balance of usability, privacy, and trustworthiness appropriate for a government entity. Strategic improvements in security headers, incident response transparency, and terms of service publication would further enhance its security posture and compliance standing.

G

Gemeente Hilversum

hilversum.nl

69

Gemeente Hilversum operates as the official municipal government website for the city of Hilversum in the Netherlands, providing a broad range of citizen services including passport applications, social benefits, parking permits, and governance information. The website targets residents and visitors, offering multilingual support and clear navigation to facilitate access to municipal resources. The business model is that of a government service provider, with a medium-sized organizational footprint and a well-established domain since 1997. Technically, the site is built on Drupal 10 CMS, leveraging modern JavaScript libraries such as jQuery and jQuery UI, and integrates third-party services like Siteimprove Analytics and GTranslate for analytics and multilingual support. The site demonstrates good mobile optimization, accessibility, and SEO practices, although performance is moderate and could be improved. From a security perspective, the website enforces HTTPS with DNSSEC enabled, uses asynchronous script loading to minimize performance impact, and avoids exposing sensitive data. However, it lacks some advanced HTTP security headers and does not provide explicit security or incident response policies publicly. Privacy compliance is strong with a clear privacy policy and cookie policy, though no explicit cookie consent mechanism is present. Overall, the website presents a high level of trustworthiness and professionalism consistent with a government entity. Recommendations include enhancing security headers, implementing a cookie consent mechanism, and publishing security and incident response information to further improve transparency and compliance.

Compararcoche.com is a Spanish online platform specializing in new car price comparison and personalized offers from official dealerships. Founded in 2022, it targets consumers in Spain seeking to purchase or rent new vehicles efficiently. The website provides detailed guides, comparisons, and facilitates lead generation for car dealerships. Technically, the site is built on WordPress using Elementor and Jet Engine plugins, hosted via GoDaddy, and employs Google Tag Manager for analytics. The site is well-structured with good SEO practices and mobile optimization. Security posture is adequate with HTTPS and domain locks, but lacks DNSSEC and advanced security headers. Privacy compliance is basic with a cookie consent mechanism but no visible privacy or terms policies. Overall, the site is professional and trustworthy but could improve transparency and security measures.

A

Allurity

allurity.com

61

Allurity is a European cybersecurity services group founded in 2014, specializing in tech-enabled cybersecurity solutions and growth partnerships for entrepreneurs and talent. The company positions itself as a leader in the cybersecurity industry with recent acquisitions to strengthen its market presence. Their website reflects a professional and consistent brand with clear messaging focused on enabling a safe digital world. Technically, the site is built on WordPress with modern frontend libraries and SEO optimizations, delivering a good user experience with mobile responsiveness and performance. Security-wise, the website enforces HTTPS, uses Google reCAPTCHA for forms, and provides cookie consent mechanisms, though it lacks some advanced security headers and explicit security policies. Overall, the domain registration and website content align well, indicating a trustworthy and legitimate business.

M

MAPFRE

mapfre.es

76

MAPFRE is a well-established Spanish insurance company offering a broad range of insurance products including home, life, health, car, motorcycle insurance, and pension plans. The website targets individual consumers in Spain, providing an easy-to-use online platform for insurance quotes and purchases. The company holds a strong market position as a large enterprise with consistent branding and a professional online presence. Technically, the website is built on WordPress with the Divi theme and integrates modern analytics and cookie consent tools, ensuring compliance with GDPR and good SEO practices. Security posture is strong with HTTPS enforced and appropriate security headers, though explicit security policies and incident response contacts are not publicly detailed. Overall, the site is trustworthy, well-designed, and compliant with privacy regulations, supporting MAPFRE's reputation as a leading insurer in Spain.

BME Growth is a specialized segment of Bolsas y Mercados Españoles (BME) focused on providing small and medium enterprises (SMEs) with access to capital markets. The platform facilitates financing, liquidity, and investor engagement for growth-oriented companies in Spain. The website demonstrates a professional and consistent branding aligned with BME's corporate identity, targeting investors and companies interested in growth market opportunities. Technically, the website employs modern web technologies including JavaScript, jQuery, Bootstrap, and integrates Google Tag Manager and Google Analytics for tracking and analytics. It also uses OneTrust for cookie consent management, indicating a mature approach to privacy compliance. The site is mobile responsive and offers a good user experience with clear navigation and relevant content. From a security perspective, the site enforces HTTPS and implements cookie consent mechanisms. However, no explicit security headers were detected in the provided data, suggesting room for improvement in security hardening. No vulnerabilities or exposed sensitive data were found in the HTML content. WHOIS data could not be retrieved due to query restrictions, limiting domain legitimacy assessment, but the website's content and affiliation with BME strongly indicate a legitimate and trustworthy entity. Overall, BME Growth's website is a well-structured, professional platform serving its niche market effectively, with good privacy compliance and a solid technical foundation. Enhancements in security headers and accessibility could further strengthen its posture.

I

Instituto de Crédito Oficial

ico.es

64

Instituto de Crédito Oficial (ICO) is a Spanish public financial institution dedicated to providing financing solutions to support investment projects and liquidity needs of self-employed individuals and SMEs. With a history spanning over 50 years, ICO plays a pivotal role in Spain's economic development by offering a comprehensive catalog of credit lines, direct financing, guarantees, and financial instruments managed on behalf of the State. The institution also engages with investors through green and social bond frameworks, emphasizing sustainability and responsible financing. Technically, the ICO website is built on the Liferay Portal CMS platform, leveraging modern web technologies including React, Google Tag Manager, Google Analytics, and Google reCAPTCHA for security and analytics. The site demonstrates good mobile optimization, accessibility, and SEO practices, providing a professional and user-friendly experience. The use of asynchronous script loading and content delivery optimizations contribute to moderate performance. From a security perspective, the website enforces HTTPS with strong SSL configurations and employs security best practices such as bot protection via reCAPTCHA and no visible exposure of sensitive data. However, explicit security policies, incident response contacts, and vulnerability disclosure mechanisms are not publicly available, representing areas for improvement. The WHOIS data for the domain is not accessible due to registry restrictions by Red.es, but the website's government affiliation and content strongly support its legitimacy. Overall, ICO's digital presence is robust and trustworthy, reflecting its status as a key government financial institution. Strategic recommendations include publishing clear security and incident response policies, enhancing transparency around data protection officers, and implementing a security.txt file to facilitate vulnerability reporting.

I

INFORMA D&B

informa.es

72

INFORMA D&B is a leading European business information provider specializing in commercial reports, market studies, and risk management solutions. The company targets businesses seeking reliable and comprehensive data to support decision-making and compliance. Their market position is strong, supported by a large user base and daily updated databases. Technically, the website employs modern JavaScript libraries, consent management tools, and analytics integrations, reflecting a mature digital infrastructure. Security posture is solid with HTTPS enforcement and privacy compliance, though some security headers and incident response details could be improved. Overall, the website presents a professional and trustworthy front with clear business focus and GDPR adherence.

C

Cepyme

cepyme.es

51

Cepyme is the Confederación Española de la Pequeña y Mediana Empresa, a national organization representing small and medium enterprises in Spain. The website serves as a platform for news, analysis, events, and advocacy related to SMEs. The organization targets Spanish SMEs and provides services such as policy advocacy, information dissemination, and event organization. The website is built on Drupal 8, utilizing modern web technologies and plugins for event management and content presentation. The technical infrastructure is moderately optimized with good mobile responsiveness and SEO practices. Security posture is adequate with HTTPS enabled and cookie consent implemented, but lacks advanced security headers and explicit security policies. The absence of WHOIS data limits domain trust verification, but the website content and branding indicate a legitimate and professional entity. Overall, the site demonstrates a solid business presence with room for improvement in security and compliance transparency.

F

Forum Groningen

forum.nl

65

Forum Groningen is a well-established cultural and educational institution based in the Netherlands, offering a wide range of services including film screenings, exhibitions, library access, workshops, and events. The website reflects a professional and consistent brand presence targeting a broad audience interested in culture and education. Technically, the site uses a modern tech stack with popular JavaScript libraries and APIs, and it is optimized for mobile and accessibility. Security posture is strong with HTTPS and DNSSEC enabled, though improvements could be made by adding security headers and publishing explicit security and privacy policies. The domain is longstanding and registered with a reputable Dutch registrar, supporting the legitimacy of the organization. Overall, the website is trustworthy and functional but would benefit from enhanced privacy compliance documentation and security transparency.

A

Atlazul

atlazul.eu

64

Atlazul is a regional cooperation initiative focused on promoting blue growth among the regions of Andalucía, Alentejo, Algarve, and Galicia. The website serves as an informational and event dissemination platform for this governmental and non-profit project. The site is built on WordPress using Elementor and integrates event management and social media feeds to engage its target audience of regional stakeholders and maritime economy participants. Technically, the site is modern and well-structured, with good mobile optimization and SEO practices. Security posture is solid with HTTPS and security headers in place, though there is room for improvement in privacy compliance and explicit contact information. Overall, the site reflects a professional and trustworthy presence for a small governmental initiative.

S

Sveučilište u Splitu

unist.hr

64

Sveučilište u Splitu is a well-established public university in Croatia, founded in 1974, serving over 20,000 students across multiple faculties and departments. The website reflects a mature digital presence with comprehensive information about academic programs, research, community engagement, and international cooperation. The institution holds the HR Excellence in Research certification, indicating a commitment to research quality and human resources standards. Technically, the website employs modern web technologies such as Bootstrap, jQuery, and Google reCAPTCHA, ensuring a responsive and secure user experience. Security posture is strong with HTTPS enforced and cookie consent mechanisms in place, although some security headers could be improved. Privacy compliance is robust with clear policies and GDPR adherence. Overall, the site projects high professionalism and trustworthiness, supporting the university's reputation and operational needs.

M

Mockab

mockab.com

34

Mockab is a small digital agency specializing in providing premium WordPress Elementor templates and an online academy to help clients create and launch websites efficiently. The website is built on WordPress using Elementor and WooCommerce, indicating a moderate level of technical maturity suitable for e-commerce and digital content delivery. The site is accessible and uses HTTPS, but lacks comprehensive privacy, cookie, and security policies, which limits its compliance posture. No contact information or incident response channels are published, which may affect user trust and regulatory compliance. Overall, the site appears to be a basic or test deployment with limited content and business information.

P

Ponte.hu Kft.

ponte.hu

65

Ponte.hu Kft. is a Hungarian technology company with over 20 years of experience specializing in artificial intelligence, web, and mobile application development. Their core offerings include AI-based frameworks, the DOKK Platform for web content management, and the ATAK automation framework. The company serves a diverse clientele including government agencies, financial institutions, and healthcare organizations, positioning itself as a trusted technology partner in Hungary. Technically, the website employs modern JavaScript frameworks such as Aurelia and React, integrates Google Maps API, and uses advanced UI components and animations, reflecting a mature digital infrastructure. Security-wise, the site enforces HTTPS, uses CSRF tokens, and implements cookie consent mechanisms, though it lacks some advanced security headers and formal security policies. Overall, the website is professional, content-rich, and trustworthy, with clear contact information and strong partner references.

A

Aiuken Cybersecurity

aiuken.com

64

Aiuken Cybersecurity is a European leader in managed cybersecurity services, specializing in MDR, SOC, and cloud security solutions. Operating in multiple countries and part of the Allurity Group, Aiuken offers expert security infrastructure management and advanced detection and response capabilities. The website demonstrates a professional digital presence with multilingual support and compliance with privacy regulations through cookie consent mechanisms. Technically, the site is built on WordPress with modern plugins and frameworks, providing a good user experience and mobile optimization. Security posture is adequate with no visible vulnerabilities or exposed sensitive data, though improvements in security headers and incident response disclosures are recommended. The absence of WHOIS data is a notable concern for domain transparency but does not detract from the overall business credibility. Strategic recommendations include enhancing security headers, publishing incident response policies, and verifying domain registration details for trust assurance.

B

BOBOCHIC

bobochicparis.com

72

BOBOCHIC is a French-based e-commerce retailer specializing in contemporary, functional, and affordable furniture and home decor products. The company targets French-speaking consumers looking for stylish home furnishings including sofas, bedroom furniture, garden furniture, and decorative items. The website reflects a medium-sized business with a consistent brand presence and a focus on customer service, including payment installment options and delivery services. Technically, the site is built on the PrestaShop CMS platform, hosted by OVH sas, and uses modern web technologies such as jQuery and Font Awesome. The site is mobile-optimized and provides a good user experience with clear navigation and relevant content. Security posture is solid with HTTPS enabled and domain protections in place, though improvements such as enabling DNSSEC and adding security headers are recommended. Privacy compliance is addressed with a comprehensive GDPR-compliant privacy policy, but cookie consent mechanisms could be enhanced. Overall, the website is professional, trustworthy, and well-positioned in the retail furniture market.

A

Athlon

athlon.com

74

Athlon is an established international provider of mobility solutions and car leasing services, targeting businesses and fleet managers across multiple European countries. The company offers a broad portfolio including full-service leasing, van leasing, rental, and innovative mobility options such as sharing, flexible leasing, e-mobility, and subscription models. The website reflects a mature digital presence with professional design, clear navigation, and comprehensive content tailored to its B2B audience. Technically, the site leverages modern web technologies including Google Tag Manager, Google Analytics, Microsoft Clarity, and Oracle Eloqua for analytics and marketing automation, integrated within a CMS environment identified as Umbraco. The site is mobile-optimized, fast-loading, and implements a detailed cookie consent mechanism aligned with GDPR requirements. From a security perspective, the website enforces HTTPS and uses secure third-party services with transparent privacy disclosures. However, explicit security headers are not detected, and no dedicated security or incident response policies are published. The absence of WHOIS registration data for the domain is a notable anomaly, potentially indicating privacy protection or registration issues, which slightly impacts the trustworthiness assessment. Overall, Athlon's website demonstrates a strong business and technical foundation with good privacy compliance and user experience. The main risk lies in the lack of visible domain registration data and limited direct contact information such as phone numbers, which should be addressed to enhance credibility and trust.

A

AUS GLOBAL Mall

ausglobalmall.com

51

AUS GLOBAL Mall is an e-commerce platform offering a diverse range of products including electronics, luxury cars, watches, health and beauty items, and jewelry. The site features a points exchange system allowing customers to redeem points for products or cash rewards. The platform is built on WordPress with WooCommerce and uses modern web technologies such as Elementor and Slider Revolution for content presentation. Translation and live chat services are integrated to enhance user experience. However, the absence of WHOIS registration data raises concerns about domain legitimacy. The website lacks visible privacy and cookie policies, and no direct contact information is provided, which impacts trust and compliance. Security posture is moderate with HTTPS enabled but missing important security headers. Overall, the site appears functional and professionally designed but requires improvements in transparency, compliance, and security to enhance credibility.

A

Asisa Dental

asisadental.es

60

Asisa Dental operates a network of dental clinics across Spain, providing a wide range of dental treatments including orthodontics, periodontics, general dentistry, implantology, dental aesthetics, and pediatric dentistry. The website presents a professional and consistent brand image, targeting patients seeking quality dental care. The business model is focused on healthcare service provision with multiple physical clinic locations, indicating a large-scale operation within the Spanish healthcare sector. Technically, the website is built on WordPress using the Astra theme and Elementor page builder, incorporating modern web technologies such as Google Tag Manager and Microsoft Clarity for analytics. The site is mobile-optimized and SEO-friendly, with structured data enhancing search engine visibility. Performance is moderate, with room for optimization. Security posture is solid with HTTPS enforced and a GDPR-compliant cookie consent mechanism in place. However, the absence of explicit security headers and incident response information suggests areas for improvement. No critical vulnerabilities or exposed sensitive data were detected. Overall, the website is trustworthy and professional, though the lack of WHOIS data limits full domain legitimacy assessment. Strategic recommendations include enhancing security headers, publishing a security policy, and maintaining regular audits of third-party scripts to strengthen security and compliance.

H

HACKRON

hackron.com

64

HACKRON is a specialized event organizer focused on cybersecurity congresses and Capture The Flag (CTF) competitions primarily in the Canary Islands, Spain. The website promotes upcoming events scheduled for 2025, targeting cybersecurity professionals and enthusiasts interested in ethical hacking. The business model revolves around event ticket sales and community engagement through calls for papers and talks. The company has a consistent brand presence and a domain registered since 2013, aligning with its operational history. Technically, the website uses a modern front-end stack including Bootstrap, jQuery, and various animation and UI libraries. Hosting and DNS are managed via Cloudflare, providing performance and security benefits, although DNSSEC is not enabled. The site is mobile optimized with good design and navigation, but lacks advanced SEO and accessibility features. No CMS is detected, indicating a custom or static site build. From a security perspective, HTTPS is implied but no explicit security headers are detected in the HTML content. The site does not implement cookie consent mechanisms or detailed privacy policies, which are compliance gaps under GDPR. Contact information is provided via email and physical address, with incident response contact channels including Telegram and email. No vulnerability disclosure or security policy pages are found, limiting transparency. Overall, the website is functional and professional but could improve its security posture and privacy compliance. The domain registration is consistent and trustworthy, supporting business credibility. Strategic improvements in security headers, cookie consent, and privacy documentation would enhance trust and compliance.

S

Serverless, Inc.

serverless.com

62

Serverless, Inc. operates the website serverless.com, providing a comprehensive Serverless Framework platform that enables developers and organizations to build, deploy, and manage serverless applications primarily on AWS Lambda and related cloud services. The company positions itself as a technology leader with a strong community presence, evidenced by significant GitHub stars, downloads, and partnerships with major enterprises such as Nordstrom and Coca-Cola. The website is professionally designed, mobile-optimized, and rich in content, targeting developers and enterprises seeking efficient serverless solutions. Technically, the website leverages modern web technologies including AWS services, JavaScript frameworks, analytics tools like Google Analytics and Hotjar, and search capabilities via Algolia DocSearch. The site is hosted likely on Webflow infrastructure, ensuring fast performance and good accessibility. However, explicit security headers and detailed security policies are not evident, which suggests room for improvement in security transparency. From a security perspective, the site uses HTTPS and secure form submission methods, but lacks published security policies, incident response contacts, and vulnerability disclosure mechanisms. The absence of WHOIS data for the domain is unusual and slightly reduces trust, although the website content and branding strongly indicate legitimacy. Privacy compliance is basic, with a cookie consent mechanism present but no clear privacy policy page. Overall, the website demonstrates a mature digital presence with strong business credibility and technical implementation but would benefit from enhanced security disclosures and privacy documentation to improve trust and compliance posture.

G

Grupo La Rabida

grupolarabida.org

44

Grupo La Rabida is an academic collaboration network of Iberoamerican universities focused on fostering academic, scientific, and cultural cooperation among its members. The website presents a professional and content-rich platform primarily in Spanish, targeting universities, researchers, and students in the Iberoamerican region. The organization appears to be medium-sized with a focus on education and scholarship programs. Technically, the site is built on WordPress with modern plugins and frameworks, offering good SEO and mobile responsiveness. Security posture is adequate with HTTPS enforced, but lacks some security headers and explicit privacy and cookie policies, which are important for compliance and trust. The WHOIS data is incomplete and malformed, which reduces domain trustworthiness despite the legitimate content and structured data on the site. Overall, the site is functional and professional but would benefit from improved transparency and compliance documentation.

S

SEA-EU

sea-eu.org

59

SEA-EU is a European University consortium uniting nine coastal universities across Europe, established in 2019. It provides educational programs, research collaboration, mobility opportunities, and joint degrees to students, staff, and researchers. The website reflects a well-structured digital presence built on WordPress with modern plugins and SEO tools, offering rich content including news, events, and an interactive opportunity browser. The technical infrastructure is solid with HTTPS enabled and good mobile optimization, though some security enhancements like DNSSEC and security headers are missing. Privacy compliance is limited due to the absence of explicit privacy and cookie policies, and no direct contact emails or phone numbers are publicly listed, relying mainly on a newsletter subscription form for contact. The domain registration is consistent with the business purpose, registered to Universidad de Cadiz in Spain, supporting legitimacy. Overall, the website is professional and trustworthy but would benefit from improved privacy disclosures and enhanced security configurations.

C

Campus del Mar CEI·MAR

campusdelmar.com

58

Campus del Mar is a Spanish academic and research initiative specializing in marine sciences and oceanographic research. The website serves as a portal for scientific infrastructures, research projects, educational programs, and international collaborations, targeting researchers, students, and marine science stakeholders. The organization holds a recognized position in Spain's marine research ecosystem with a medium-sized operational scale and a founding date consistent with the domain registration in 2009. Technically, the website is built on WordPress using Elementor and WooCommerce, with moderate performance and good mobile optimization. Security posture is adequate with HTTPS enabled and use of reCAPTCHA, but lacks DNSSEC and some security headers. Privacy compliance is partial, with a privacy policy present but no cookie consent mechanism. Overall, the site is professional and trustworthy but could improve in security and privacy transparency.

N

NETOPIA Payments

mobilpay.ro

70

NETOPIA Payments is a leading Romanian payment processing company offering a wide range of online and mobile payment solutions including card payments, SMS payments, digital wallets, and marketplace payment services. With over 19 years of experience and more than 25,000 merchants served, the company holds strong market positioning in the local finance and e-commerce sectors. Their website reflects a professional and comprehensive digital presence with clear service offerings and trust signals such as PCI DSS Level 1 and ISO/IEC 27001 certifications. Technically, the website is built on WordPress with a modern technology stack including jQuery, Google Tag Manager, and Cookiebot for consent management. The site is mobile optimized and SEO friendly, though performance is moderate. Security posture is strong with HTTPS enforced, 3D-Secure transaction processing, and advanced anti-fraud filters. However, DNSSEC is not enabled and some security headers are not explicitly detected, representing areas for improvement. Privacy compliance is well addressed with clear privacy and cookie policies and GDPR compliance indicators. Contact information is primarily via contact forms and support portals, with no direct emails or phone numbers publicly listed. Incident response contact details and vulnerability disclosure mechanisms are not found, which could be enhanced to improve security transparency. Overall, NETOPIA Payments demonstrates a mature and trustworthy online presence with solid business credibility and security practices. Strategic improvements in DNS security, security headers, and incident response transparency would further strengthen their security posture and trustworthiness.

G

GGD regio Utrecht

ggdru.nl

65

GGD regio Utrecht is a regional public health organization serving 26 municipalities in the Utrecht region of the Netherlands. The website provides health support and information primarily targeting residents and professionals within this region. The organization appears well-established with a domain age since 2013 and consistent WHOIS data. The website is built on WordPress and employs modern technologies including Google Analytics 4 and Google Tag Manager for analytics and tracking, with a functional cookie consent mechanism that aligns with GDPR requirements. The site is well-structured, mobile-optimized, and accessible, reflecting a mature digital presence. Security posture is strong with HTTPS enforced and DNSSEC enabled, though explicit security policies and incident response contacts are not publicly available. Overall, the website demonstrates a good balance of usability, compliance, and security appropriate for a public health authority.

G

GGD

ggdgv.nl

63

GGD Gooi en Vechtstreek is a regional public health service organization serving multiple municipalities in the Netherlands. The website provides comprehensive information about public health services including youth and family health, infectious disease control, vaccinations, and childcare supervision. It targets residents, healthcare professionals, and local government partners in the Gooi en Vechtstreek region. The organization positions itself as a trusted government health authority with a clear regional focus and a medium-sized operational scale. Technically, the website is built on WordPress using modern plugins and technologies such as Google Tag Manager, Google Analytics, Microsoft Clarity, and Slider Revolution. The site is mobile-optimized, accessible, and SEO-friendly with proper metadata and structured data. Performance is moderate with good user experience and navigation clarity. From a security perspective, the site enforces HTTPS and implements cookie consent mechanisms aligned with GDPR requirements. However, explicit security policies, incident response contacts, and vulnerability disclosure mechanisms are not found. Security headers could be enhanced to improve protection. No critical vulnerabilities or exposed sensitive data were detected. Overall, the website demonstrates a solid digital presence with good privacy compliance and business credibility. The domain registration data aligns well with the organization's identity, supporting legitimacy. Strategic recommendations include publishing security policies, enhancing security headers, and adding incident response contact information to strengthen trust and compliance.

G

GGD Gelderland-Zuid

ggdgelderlandzuid.nl

73

GGD Gelderland-Zuid operates as a regional public health organization serving the Gelderland-Zuid area in the Netherlands. The website provides health-related information and services targeted at residents and healthcare professionals within the region. The organization is positioned as a governmental public health authority with a medium-sized operational scope, founded in 2011. The website's content and branding are consistent and professionally presented, supporting its role as a trusted health information source. Technically, the website is built on WordPress CMS, utilizing modern tools such as Yoast SEO Premium for search engine optimization, Cookiebot for cookie consent management, and Font Awesome for iconography. The site loads external scripts from reputable sources and implements DNSSEC and HTTPS, indicating a secure and modern infrastructure. Performance and mobile optimization are assessed as good, with accessibility features in place. From a security perspective, the site benefits from HTTPS and DNSSEC, and employs a cookie consent mechanism, but lacks visible security headers and published security policies or incident response information. No vulnerabilities or exposed sensitive data were detected in the provided content. Privacy compliance is partial, with cookie consent present but no explicit privacy policy found. Business credibility is strong due to domain age, consistent registration data, and professional presentation. Overall, the website presents a moderate to good risk profile with room for improvement in privacy policy publication, security header implementation, and incident response transparency. Strategic enhancements in these areas would strengthen trust and compliance.

G

GGD Zaanstreek-Waterland

ggdzw.nl

67

GGD Zaanstreek-Waterland is a regional public health authority in the Netherlands providing vaccination services, health advice, and reliable public health information to residents and professionals in the Zaanstreek-Waterland region. The website is professionally designed, well-branded, and targets local citizens and healthcare professionals. The digital infrastructure is based on WordPress with modern plugins and technologies such as Yoast SEO and Google reCAPTCHA, indicating a mature technical setup. Security posture is strong with HTTPS, security headers, and a cookie consent mechanism in place, although dedicated security policies and incident response contacts are not published. Overall, the site demonstrates good compliance with GDPR and privacy standards, with clear contact channels and social media presence enhancing trust. The domain registration data aligns well with the organization's identity, supporting legitimacy.

V

Veiligheidsregio Rotterdam-Rijnmond

vr-rr.nl

70

Veiligheidsregio Rotterdam-Rijnmond (VRR) is a Dutch regional government organization responsible for coordinating emergency services including disaster management, crisis control, fire brigade, ambulance care, and medical assistance across 13 municipalities. The website serves as an official portal providing information, news, and resources related to safety and emergency preparedness for residents and stakeholders in the Rotterdam-Rijnmond region. The organization maintains a strong regional presence with active social media channels and partnerships with related safety platforms such as rijnmondveilig.nl. Technically, the website is built on the IPROX.NET 4 CMS platform, integrating modern web technologies and third-party services like Google Analytics 4 and Zoho SalesIQ for analytics and live chat support. The site is mobile-optimized, accessible, and SEO-friendly, with a moderate performance profile. Security is well-managed with HTTPS and DNSSEC enabled, secure forms with CSRF tokens, and a cookie consent mechanism. However, the site lacks explicit security headers and published security or privacy policies, which are recommended for enhanced compliance and trust. The security posture is solid for a government site, with no visible vulnerabilities or exposed sensitive data. The domain is long-established (since 2005) and registered with a reputable Dutch registrar (KPN), consistent with the organization's history and legitimacy. Overall, the site demonstrates a high level of professionalism and trustworthiness, though improvements in privacy policy transparency and security headers would strengthen compliance and user confidence. Strategic recommendations include publishing comprehensive privacy and security policies, implementing additional security headers, and establishing a vulnerability disclosure program to further enhance the site's security and compliance posture.

V

Veiligheidsregio Haaglanden

vrh.nl

71

Veiligheidsregio Haaglanden is a Dutch regional government organization focused on public safety and emergency services in the Haaglanden region. The organization encompasses fire services, crisis management, and ambulance coordination, serving residents and visitors with a clear mission to maintain a safe environment. The website reflects this mission with comprehensive information, official contact details, and active social media engagement. Technically, the site is built on Drupal 10, employs modern web technologies, and integrates privacy and cookie consent mechanisms aligned with GDPR requirements. Security posture is solid with HTTPS enforcement and some security best practices, though explicit security policies and vulnerability disclosure mechanisms are absent. Overall, the site is professional, trustworthy, and well-maintained, supporting the organization's public service role effectively.

V

Veiligheidsregio Brabant Zuidoost

vrbzo.nl

73

Veiligheidsregio Brabant Zuidoost operates as a regional governmental organization focused on public safety and emergency management within the Brabant-Zuidoost region of the Netherlands. The website serves as an informational and communication platform for residents, municipalities, and partners, emphasizing safety collaboration and risk profiling. The organization positions itself as a key regional safety authority, providing essential services related to emergency preparedness and public safety coordination. Technically, the website is built on WordPress, leveraging popular plugins such as Yoast SEO for search optimization and Cookiebot for GDPR-compliant cookie management. The site integrates modern technologies including jQuery, Bootstrap, Google Tag Manager, and Hotjar for analytics and user behavior tracking. The site demonstrates good mobile responsiveness and basic accessibility features, with a moderate performance profile. From a security perspective, the site enforces HTTPS with strong SSL configuration and includes standard security headers. Cookie consent mechanisms are robust, and no exposed sensitive data or vulnerable libraries were detected. However, explicit security policies and incident response contacts are absent, representing areas for improvement. The domain registration details align well with the website's governmental nature, supporting high legitimacy and trust. Overall, the website presents a professional, trustworthy, and compliant digital presence for a regional government entity. Strategic recommendations include publishing detailed security and incident response policies, enhancing accessibility, and maintaining regular audits of third-party scripts to sustain security and compliance posture.