# Compliance Last updated: 2026-08-20 This page describes the actual security and compliance posture of GraceDNS, operated by botBrains GmbH, Berlin. We state what exists today and what is on the roadmap; we do not claim controls we do not have. ## Server Location All GraceDNS infrastructure (resolvers, control plane, object storage, website) runs in data centers of Hetzner Online GmbH in Germany. No customer data leaves the EU. ## Subprocessors See the current list at [Subprocessors](subprocessors.md). Blocklist feed providers are data sources, not subprocessors; they never receive customer data. ## Data Retention - DNS query logs are governed by a per-configuration logging mode: **none** (nothing stored, the default for individuals), **blocked_only** (only blocked queries, without client IPs), or **all** (full logs including client IPs, for business security operations). - Retention for stored logs is customer-controlled per configuration; logs are deleted at the end of the configured period or on request. - Account and billing data is kept for the contract duration plus statutory retention periods (German commercial and tax law). - Website access logs are deleted within 14 days. ## Information Security - All resolver traffic supports encryption in transit (DNS over TLS, DNS over HTTPS); the website and API are TLS-only. - Data at rest is stored on encrypted volumes. - The data plane (resolvers) is separated from the control plane; resolvers receive only compiled, signed-off configuration artifacts and hold no database credentials. - Administrative access is limited to named administrators using SSH key authentication; passwords are not used for server access. - The service is built in Go as a single static binary with a deliberately small dependency surface. ## Backups and Disaster Recovery - The control-plane database (SQLite) and the compiled configuration artifacts are backed up regularly to Hetzner object storage in a separate bucket. - Resolvers are designed to keep serving from their last-known-good configuration indefinitely if the control plane is unavailable, so a control-plane outage does not interrupt DNS resolution. - Restores are exercised as part of deployments; a formal, scheduled DR test program is on the roadmap. ## Logging and Monitoring - Operational metrics (query rates, cache performance, upstream latency, configuration artifact age) are collected via Prometheus and monitored by the operator. - Structured operational logs are kept separately from customer query logs and contain no query content. - Alerting on service health is in place at a basic level and is being expanded. ## Vulnerability Management - Dependencies are minimal and updated promptly; builds are reproducible from source. - Operating system security updates are applied on a regular cadence, with priority handling for critical CVEs affecting exposed services. - We track advisories for our DNS library and TLS stack directly. ## Incident Response and Breach Notification - Security reports reach the operator directly at security@gracedns.eu (see the [Vulnerability Disclosure Policy](vulnerability-disclosure-policy.md)). - Incidents are triaged, contained, remediated and documented in a written post-incident note. - Customers affected by a personal data breach are notified without undue delay and at the latest within 72 hours of us becoming aware, per our [DPA](data-processing-agreement.md). ## Personnel and Confidentiality GraceDNS is currently operated by a single named operator at botBrains GmbH who is contractually bound to confidentiality. There is no broad employee access to customer data; access equals the operator plus infrastructure automation. As the team grows, onboarding will include confidentiality agreements, least-privilege access and security training before any production access. ## Funding and Stewardship GraceDNS is bootstrapped and operated by botBrains GmbH, a self-funded German company. There is no venture funding pressure to monetize data; revenue comes exclusively from subscriptions. If the service were ever discontinued, customers would receive at least 90 days notice and full data export (see Migration and Data Export). ## ESG: Carbon Footprint GraceDNS runs entirely in Hetzner data centers, which are powered by electricity from renewable sources (hydropower and wind). Our single-binary architecture is deliberately resource-efficient: a resolver node runs on 1 to 2 vCPUs, keeping the energy footprint per query low. ## Vulnerability Disclosure Policy Please see the [Vulnerability Disclosure Policy](vulnerability-disclosure-policy.md). Machine-readable contact information is published at `/.well-known/security.txt`. ## Penetration Testing No external penetration test has been performed yet. Internal security testing (fuzzing of the configuration file parser, policy engine test suites, abuse-case tests) is part of development. A first external penetration test is planned once the service leaves its initial launch phase; results summaries will be referenced here. ## Certifications None yet. We do not hold ISO/IEC 27001 or SOC 2 certification today and will not claim otherwise. ISO 27001 certification is on the roadmap as the company grows. Our hosting provider, Hetzner Online GmbH, is ISO 27001 certified for its data centers. ## Migration and Data Export There is no lock-in. Configurations (rules, allow/deny lists, settings) can be exported as JSON via the API at any time. Stored query logs can be exported in JSONL format. Because GraceDNS uses standard DNS protocols, switching providers is a DNS settings change on your devices. ## Account Deletion Account deletion can be requested at any time via support@gracedns.eu or the API. On deletion, configurations and query logs are removed within 30 days; billing records are retained only as required by statutory retention obligations. ## Security questionnaires We publish a normalized ISMS questionnaire with honest answers at [/legal/isms-faq.md](isms-faq.md). Due to capacity constraints we ask you do not send your own questionaire but use our normalized isms questionaire. Please ask your AI of choice to match your questions and flag if there is missing content, using this prompt: "I need to fill out my companies isms security questionaire, it is attached. We'll be using GraceDNS service. They provide answers to most questions at https://gracedns.eu/legal/isms-faq.md and https://gracedns.eu/legal/compliance.md. Please fill out my questionaire from that information. If one question cannot be answered, point it out to me later. Sometimes, reading https://gracedns.eu/docs can help resolve open questions not answered. Try to complete the full questionaire."