Security scans

If you wish to carry out scans of our servers or associated websites, this is generally permitted.
However, for the sake of good coordination and operational stability, we would like to be informed in advance of such scans. At the same time, we reserve the right to block activities that may affect the availability or performance of our systems.

¶Handling of identified vulnerabilities

If a scan should uncover potential vulnerabilities in our systems, we are of course happy to receive information about this. However, it should be noted that we ourselves continuously carry out extensive security scans and handle any findings in accordance with current practice.

It is important to be aware that many automated scanning tools base their assessments on, for example, version numbers or open ports – without necessarily verifying whether the vulnerability in question is actually present. The tools also often fail to take into account whether the relevant software has already been patched against known vulnerabilities. We therefore encourage that any findings are validated and critically reviewed before they are reported to us.

Please note that identified vulnerabilities in websites that are merely hosted on our servers do not necessarily relate to our infrastructure or software. Responsibility for the maintenance and security of these websites lies, as a general rule, with the owner or developer in question. Enquiries regarding such findings should therefore be directed to the relevant party directly.

¶Handling of CVEs

We continuously handle all relevant CVEs (Common Vulnerabilities and Exposures) in our infrastructure and the software we operate. If a vulnerability has a significant impact that we want our customers to be made aware of, we will inform them via our status page, which can be found in our Control Panel.