Security scans

If you wish to carry out scans of our servers or associated websites, this is generally permitted.
For the sake of good coordination and operational stability, however, we would like to be informed in advance of such scans. We also reserve the right to block activities that may affect the availability or performance of our systems.

¶Handling of identified vulnerabilities

If a scan should uncover potential vulnerabilities in our systems, we are of course happy to receive information about them. It should be noted, however, that we ourselves continuously carry out extensive security scans and handle any findings in accordance with current practice.

It is important to be aware that many automated scanning tools base their assessments on, for example, version numbers or open ports – without necessarily verifying whether the vulnerability in question is actually present. The tools also often fail to take into account whether the relevant software has already been patched against known vulnerabilities. We therefore encourage that any findings are validated and critically reviewed before they are reported to us.

Please note that identified vulnerabilities in websites that are merely hosted on our servers are not necessarily related to our infrastructure or software. Responsibility for the maintenance and security of these websites lies, as a general rule, with the owner or developer in question. Enquiries regarding such findings should therefore be directed to the relevant party.

¶Handling of CVEs

We continuously handle all relevant CVEs (Common Vulnerabilities and Exposures) in our infrastructure and the software we operate. If a vulnerability has a significant impact that we wish to make our customers aware of, we inform about it in our operations overview, which can be found in our Control Panel.
Just because a CVE is not mentioned does not mean that we have not assessed it or acted upon it; it is our task to handle any CVEs, and we do so.