TECHNICAL TRANSPARENCY

PRIVACY & DATA AUDIT

This document outlines the technical data-handling properties of the Kernel Co. GmbH website based on an objective audit of the codebase, runtime mechanisms, and dependencies.

// CONTROLLER CONTACT

Kernel Co. GmbH

Email: office@kernel-co.com

// 1. Verified in Repository

The following facts are verified directly within our static repository architecture:

  • Theme Persistence: The client-side application uses browser localStorage solely to persist the user theme choice (dark/light mode under the key "theme").
  • No Tracking Scripts: No invasive third-party tracking, profiling, conversion pixels, or analytics tools (e.g., Google Analytics, Meta Pixels, Mixpanel) are bundled, imported, or executed by the repository code.
  • Disabled Contact Form: The visual contact form is completely disabled in front-end client code. No network transmission, fetch, or XMLHttpRequest endpoints are triggered by interaction with form inputs or submission buttons.
  • Local Typography Fonts: Our stylesheet loads typography fonts locally from our own self-hosted static directory. No requests are sent to external Google servers, and no user IP addresses are disclosed to third parties during font retrieval.

// 2. Dependent on Deployment Configuration

Security-related response headers and client fallback behaviors cannot be fully verified within the static code repository. These must be confirmed upon actual build delivery:

  • HTTP Response Headers: Important protections such as Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Content-Type-Options, and X-Frame-Options must be configured at the server/hosting ingress layer.
  • Wildcard Routes & Error Responses: React Router handles 404 views entirely inside the browser. Configuring the web server to serve index.html as the fallback for all non-static paths is required, but it returns HTTP 200 instead of a native HTTP 404 unless specific server redirection rules are implemented.

// 3. Dependent on Hosting Provider

Standard data logging and infrastructure services are governed strictly by the policies of the hosting provider (e.g., Google Cloud Run, Nginx, or other proxies used):

  • Standard Access Logs: Web servers automatically record visitor IP addresses, browser user-agents, referring URLs, request timestamps, and response status codes to maintain host stability, security, and DDoS mitigation.
  • Infrastructure Cookies: While the application code does not generate cookies, server load-balancers or CDN routing layers may place transient cookies for session stickiness or threat intelligence checks.

// 4. Requiring Legal Review

Prior to production release and legal validation, the following operational requirements must undergo formal review:

  • Data Protection Officer & Controller: The exact legal entity name, corporate address, trade register registration, and specific contact email for the designated Controller must be validated and published.
  • Data Processing Agreement (DPA):_A formal DPA must be established with the hosting provider in compliance with Art. 28 GDPR to ensure lawful data retention and access parameters.
  • Verified Contact Inbox: The email placeholder VERIFIED_CONTACT_EMAIL in the repository must be populated with a secure corporate-controlled inbox that is fully monitored by Kernel Co. GmbH personnel.