GraceDNSISMS FAQ#
Last updated: 2026-08-20
Normalized security questionnaire for GraceDNS, operated by botBrains GmbH, Berlin. Answers are honest v0 statements: we describe what exists today and mark roadmap items as roadmap. See also Compliance and Subprocessors.
Certification#
Are you currently certified to ISO/IEC 27001? If yes, please provide the certificate and its scope.
No. botBrains GmbH does not currently hold an ISO/IEC 27001 certification and we will not claim otherwise. ISO 27001 is on our roadmap as the company grows. Our hosting provider, Hetzner Online GmbH, operates ISO 27001 certified data centers, and we can provide Hetzner's certificate on request.
Security governance#
Do you operate a formal information security management programme or ISMS?
We operate a lightweight, documented security program appropriate for a single-operator company: documented architecture and data flows, defined logging and retention modes, a published vulnerability disclosure policy, an incident response procedure with 72-hour breach notification, and this public FAQ. It is not a certified ISMS. Formalization toward ISO 27001 is planned.
Data access#
What information belonging to us will you access, process, store, or transmit?
DNS query data from your users and devices: the queried domain name, record type, timestamp, protocol, configuration identifier and (depending on protocol and configuration) the client IP address. What we store depends entirely on the logging mode you set per configuration: none (nothing stored), blocked_only (blocked queries without client IPs), or all (full logs including client IPs). We additionally store your account contact data, your configurations (custom rules, allow/deny lists, linked IP ranges) and billing data.
Data location#
In which countries/regions will our data be stored and processed?
Germany, exclusively. All resolvers, the control plane and object storage run in Hetzner data centers in Germany. No customer data is transferred outside the EU.
Access control#
How do you control employee and administrator access to customer data?
GraceDNS is operated by a single named administrator. Production access is limited to that administrator via SSH with key-based authentication; there are no shared accounts and no password-based server logins. The resolver data plane holds no database credentials; it only receives compiled configuration artifacts. As the team grows, access will follow least privilege with per-person accounts.
MFA#
Is MFA required for privileged accounts and systems containing customer data?
Yes for the accounts where it applies: the Hetzner cloud console and object storage management, the domain registrar and the code hosting accounts are protected with multi-factor authentication. Server access uses SSH keys instead of passwords. The v0 control-plane API uses a single high-entropy admin token; user-facing accounts with MFA are on the roadmap for the web application.
Encryption#
Is customer data encrypted in transit and at rest?
In transit: yes. The website, API, DoT and DoH endpoints are TLS-encrypted, as is artifact distribution to resolvers and log shipping to object storage. Note that classic DNS on port 53, if you choose to use it, is unencrypted by protocol design; we offer DoT and DoH so you do not have to. At rest: yes, customer data is stored on encrypted volumes and in Hetzner object storage with server-side encryption.
Personnel#
Are employees with access to sensitive/customer information subject to appropriate screening, confidentiality obligations, and security training?
The single operator with production access is contractually bound to confidentiality and is the person who designed and built the security controls. There are no further employees with access today. Any future hire will sign confidentiality obligations and complete security onboarding before receiving any production access.
Vulnerability management#
Do you have documented vulnerability and patch-management processes?
Yes, at a scale appropriate to the service: operating system security updates are applied on a regular cadence with expedited handling for critical CVEs on exposed services; our Go dependency surface is deliberately small and monitored; advisories for our DNS and TLS libraries are tracked directly. The process is documented internally.
Security testing#
Do you perform vulnerability scanning and/or penetration testing regularly?
Internal security testing is part of development: fuzz testing of the configuration file parser (malformed input must never crash the resolver), policy engine test suites, and abuse-case tests. No external penetration test has been performed yet; the first one is planned after the initial launch phase. We do not claim otherwise.
Incident response#
Do you maintain and test an information-security incident-response process?
We maintain a documented incident response procedure (triage, containment, remediation, written post-incident note, customer notification). Given the size of the operation it is exercised through real operational events and deployment drills rather than formal tabletop exercises; scheduled testing is a roadmap item.
Breach notification#
How quickly will you notify us of a security incident affecting our data or services?
Without undue delay and at the latest within 72 hours of becoming aware of a personal data breach affecting your data, as committed in our Data Processing Agreement. Service-affecting incidents are communicated as they are handled.
Business continuity#
Do you maintain and periodically test business continuity and disaster-recovery arrangements?
The architecture is the primary continuity control: resolvers keep serving DNS from their last-known-good configuration indefinitely even if the control plane fails completely, so the customer-facing service survives control-plane outages. Control-plane state (SQLite database, compiled artifacts) is backed up to separate object storage and can be restored to a fresh server. Restores are exercised during deployments; a formal scheduled DR test program is on the roadmap.
Backups#
Are backups performed and tested, and are they appropriately protected?
Yes. The control-plane SQLite database and the compiled configuration artifacts are backed up regularly to a separate Hetzner object storage bucket in Germany, encrypted in transit and at rest, with access restricted to the operator. Backup restores are verified as part of deployment practice.
Subprocessors#
Do you use subcontractors/subprocessors to deliver the service?
Yes, two: Hetzner Online GmbH (hosting and object storage, Germany) and the subprocess.io mail forwarding service (inbound email for our contact addresses). The current list with details is maintained at Subprocessors. Blocklist feed providers are data sources we download from; they receive no customer data and are not subprocessors.
Supply chain#
How do you assess the information-security risks of your own critical suppliers/subprocessors?
Hetzner was selected for its ISO 27001 certified data centers, EU jurisdiction and GDPR data processing agreement, which we have concluded. Blocklist feeds are treated as untrusted input: they are parsed defensively in the control plane, compiled offline, and a failed or empty feed fetch never propagates to resolvers (last-known-good data is kept). Software dependencies are few, pinned and reviewed on update.
Changes#
Will you notify us of significant changes to your service, infrastructure, subprocessors, or security controls?
Yes. Subprocessor additions or replacements are announced at least 30 days in advance on the Subprocessors page and by email to account holders. Material changes to the service, terms or security posture are announced by email with at least 30 days notice where they affect contractual commitments.
Compliance#
What security/privacy regulations and contractual requirements apply to the service?
The EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) as we are a German company processing data in Germany; German telemedia and commercial law for the website and contracts; and the Art. 28 GDPR data processing agreement we conclude with business customers. We are not currently subject to sector-specific regimes such as PCI DSS or HIPAA and do not process payment card data ourselves.
Audit evidence#
Can you provide relevant independent assurance reports, such as ISO 27001, SOC 2, penetration-test summaries, or equivalent?
Today we can provide: Hetzner's ISO 27001 certificate for the hosting layer, our public compliance documentation (Compliance), and this FAQ. We do not yet have our own ISO 27001 or SOC 2 report or an external penetration test summary; these are roadmap items and this page will link them when they exist.
End of contract#
What happens to our information when the contract ends, including deletion, return, backups, and account termination?
You can export your configurations (JSON via API) and stored query logs (JSONL) before or at termination. After termination, configurations and query logs are deleted within 30 days, including expiry from backups within the backup rotation period. Billing records are retained only as long as German statutory retention requires. Account termination is available at any time via support@gracedns.eu or the API.
Monitoring#
How do you monitor the effectiveness of your security controls and address identified deficiencies?
Operational metrics (query rates, block rates, upstream latency, configuration artifact freshness, log spool depth) are collected via Prometheus with basic alerting. Feed health is tracked per source and unhealthy feeds are flagged rather than silently shipping empty lists. Deficiencies found through monitoring, testing or external reports are tracked to remediation by the operator; security reports reach us directly at security@gracedns.eu.
Past incidents#
Have you experienced any material security incidents relevant to the service in the last 24 months? If yes, what remediation was performed?
No. GraceDNS launched in 2026 and has had no material security incidents to date. If one occurs, affected customers will be notified per our breach notification commitment and a remediation summary will be provided.