Discuss your project

LEGAL

PRIVACY POLICY.

What data is processed when you visit this website, for what purpose, on what legal basis – and what rights you have.

This is a translation for convenience. The German version is legally binding.

01Controller

TOMORIS GmbH
Saturnstraße 1
4614 Marchtrenk
Austria

Email: contact@tomoris.com
Phone: +43 7243 53091

02Purpose and scope

This privacy policy describes the processing when you visit this website, when you select external links, when you contact us by email or via the website form and when you request a download. The website explains on the form whether direct transmission is enabled.

Fonts and images are delivered with the website. Google Analytics is only loaded on our production website once you consent to statistics. A separate choice is provided for additional ad measurement. The following sections explain the purposes and your choices.

03Hosting and delivery

The website is delivered as a Next.js/Node.js application, together with its static files, via the existing Hostinger application. Technically necessary server and access logs may be created when the website is accessed. They contain, for example, the time, the requested resource, the transfer status and the connection (including the IP address).

The servers and the processing of these logs are located in the EU. Hostinger processes them as a processor and, according to its own information, keeps them as long as necessary for operation; Hostinger does not state a specific period for this.

04Contacting us

The form processes topic, name, email address and message, and optionally company and phone number, in order to pass your request on to TOMORIS and answer it. When you register for the Ambassador Program, your relationship to TOMORIS and your interests are added; they are placed at the beginning of the message.

Direct sending from the website is enabled in the active runtime configuration. After successful validation and abuse checks, a plain-text message is passed via the technical sending mailbox website@tomoris.com to the fixed production recipient contact@tomoris.com.

The visitor’s address is used exclusively as Reply-To. It cannot determine the sender, recipient, Cc or Bcc. The application code does not store the message or contact details in its own database or file and does not write them to application logs. After handover, your request is processed further in the TOMORIS Microsoft 365 mailbox.

Providing your data is voluntary. Without name, email address and message, however, we cannot process your request via the form; alternatively, you can reach us by phone.

05Downloads by email

We send the PDFs on the download pages to you by email. For this purpose we process the email address you enter in the form, together with the selected document and the language of the page. The sole purpose is to send the requested PDF. The email address is the only required field.

After successful validation and abuse checks, the website passes the message with the PDF as an attachment via the technical sending mailbox website@tomoris.com to Microsoft Graph and Exchange Online. The recipient of your address is therefore Microsoft, which delivers the message. If direct sending is disabled, the form does not accept an address.

Without the tick, TOMORIS does not store your address or pass it on: the application code does not keep it in its own database or file, does not write it to application logs and keeps no copy of the message in the sending mailbox. To limit requests, the server holds a non-reversible check value of the address in working memory for up to two hours; it is known only to the running process and ends at the latest when that process restarts. For delivery, Microsoft keeps technical message logs with sender, recipient and subject, which according to Microsoft are retained for 90 days. If the message cannot be delivered, the automatic non-delivery report with your address goes to the sending mailbox. It is deleted there automatically after 30 days.

The tick for being contacted is optional and not preselected; the download does not depend on it. If you set it, an additional internal message with your address and the selected download goes to contact@tomoris.com so that we can contact you about this topic. You can withdraw this consent at any time via contact@tomoris.com.

We report requests made via this form neither to TOMORIS Commerce nor to Google Ads.

06Toolbox: free check tools

The check tools marked “checked by DarkWatch” (email security, DNS security, SSL/TLS, security headers, security.txt, cookies, mixed content, redirects, robots.txt, versions, certificates, lookalike domains, Microsoft 365 and the website security check) are run by DarkWatch, the leak and security monitoring of TOMORIS GmbH, on servers of TOMORIS GmbH. For this, your browser sends your input directly to darkwatch-api.tomoris.io; where “our web server” appears below, these tools mean the DarkWatch server, and it makes DNS queries via the resolver of its data centre. DarkWatch keeps the result in memory for five minutes and limits checks to ten in ten minutes per sender, using a salted hash of your IP address that exists in memory only. Only the tool, the duration and the result code are logged, neither your input nor your IP address. For free continuous monitoring (DarkWatch Free) you move to darkwatch.tomoris.io, where its privacy notice applies.

With the server-side check tools of the TOMORIS Toolbox, such as the security header check, you enter a domain or web address. Our web server then retrieves the specified website and creates the report from it. Depending on the tool, this means the page you entered, its redirects with and without www, its robots.txt and a sitemap; or it queries the domain’s public DNS records instead. The checked website receives a request from our server, not your IP address.

For the DNSSEC check of the DNS security check, our web server queries the DS and DNSKEY records of the entered domain from Cloudflare’s public DNS resolver (DNS over HTTPS). Cloudflare receives the domain name and our server’s IP address, not your IP address. According to its own information, Cloudflare does not permanently store the requesting IP address for its public resolver and deletes the resolver logs within 25 hours. Our web server makes all other DNS queries via its hosting provider’s resolver. With the cookie check, the checked website sets its cookies for our web server, not in your browser. We only evaluate names and attributes and include the values neither in the report nor in the cache.

With the Microsoft 365 domain check, our web server additionally retrieves the public sign-in metadata (OpenID Connect) for the entered domain once from Microsoft at login.microsoftonline.com. This shows whether Microsoft assigns a Microsoft Entra tenant to the domain. Microsoft receives the domain name and our server’s IP address, not your IP address; we do not query user accounts.

With the certificate transparency check, our web server queries crt.sh for the certificates of the entered domain and its subdomains. crt.sh is a search across the public Certificate Transparency logs operated by Sectigo. Sectigo receives the domain name and our server’s IP address, not your IP address. We keep the response from crt.sh in the web server’s memory for up to one hour, so that repeated checks of the same domain do not put renewed load on crt.sh. With the lookalike domain check, our web server queries public DNS records via its hosting provider’s resolver for up to 40 spelling variants derived from your input; it does not access the websites of these domains. For the list of Microsoft 365 endpoints, our web server retrieves the published Microsoft 365 addresses from Microsoft at endpoints.office.com at most once per hour. No input or data from you is transmitted; Microsoft only receives our server’s IP address and a fixed identifier of the request.

We do not store your input and the result permanently. We keep the result in the web server’s memory for five minutes, so that a repeated check of the same address does not put renewed load on the target website; it is deleted after six minutes at the latest. To limit checks to twelve per minute, we keep a salted hash of your IP address in memory; it is deleted after two minutes at the latest. Both are gone after a restart of the web server. Tools that run entirely in your browser do not transmit your input to us; this is stated for each tool.

You may start the website security check via the input field on the home page, or open another tool for the same domain from a report. In that case, your browser briefly stores the domain in the session storage of this browser tab (tomoris-toolbox-handoff) for the switch to the tool page. The tool page reads the entry when it loads and deletes it immediately. Without JavaScript, or if you open a link in a new tab, the domain appears in the address of the tool page instead (?domain=).

Before every check on our web server, Cloudflare Turnstile protects the Toolbox against automated abuse, as described in the following section; for the checks by DarkWatch, as soon as DarkWatch requires the bot check.

Daily monitoring (subscription). Below the result of a check tool you can have the checked domain monitored daily, free of charge. For this we process your email address, the domain, the selected tools, the language and the time of your consent. The address must belong to the domain. The subscription only starts when you click the link in our confirmation email (double opt-in); the link is valid for 72 hours, after which we delete the unconfirmed request.

The website forwards the request encrypted to a TOMORIS server that keeps the subscriptions, checks the domain daily with the same tools as this website and, if the website check is selected, queries the website for availability every five minutes. From each run we only store the grade and the identifiers of critical findings, for at most 400 days. We send emails via Microsoft 365 (section Microsoft 365) from the mailbox toolbox@tomoris.com, only when something gets worse and at most one summary per day; after sending, only the type and time of an email remain. As proof of consent we store the version and checksum of the consent text shown and a hash of your IP address formed with a secret, not the address itself.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with one click on the unsubscribe link in every email or by email to contact@tomoris.com. The subscription ends automatically after 12 months. We keep the subscription data and the proof of consent for three years after the end in order to be able to prove the consent, and then delete them. The optional box "TOMORIS may contact me about the results" is a separate consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021); without it we use your address only for monitoring.

Security Briefing (webinar and emails). On the Security Briefing page you can sign up for our monthly webinar. For this we process your email address, the language, the time of your consent and, if you arrive through a campaign, its identifier (such as “linkedin-2026-12”). The sign-up only takes effect when you click the link in our confirmation email (double opt-in); the link is valid for 72 hours, after which we delete the unconfirmed request. The confirmation email contains no advertising.

The website forwards the request encrypted to a TOMORIS server that keeps the sign-ups. Via Microsoft 365 (section Microsoft 365) we send you from the mailbox toolbox@tomoris.com the welcome email, the join link on the day before each session and, after the session, the recording with a checklist; after sending, only the type and time of an email remain. The webinar itself takes place in Microsoft Teams; participants have camera and microphone off. Recordings only show the speakers and are published on YouTube (Google Ireland Limited). As proof of consent we store the version and checksum of the consent text shown and a hash of your IP address formed with a secret, not the address itself.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021), which you can withdraw at any time with one click on the unsubscribe link in every email or by email to contact@tomoris.com. The unsubscribe takes effect immediately for all marketing emails from TOMORIS: we put your address on a suppression list that only holds a hash of the address, and withdraw a contact consent from domain monitoring; we keep this entry so that the objection stays effective (Art. 6(1)(c) and (f) GDPR). We keep the sign-up data and the proof of consent for three years after unsubscribing in order to be able to prove the consent, and then delete them.

07Cloudflare Turnstile

When direct sending is enabled, Cloudflare Turnstile protects the form against automated abuse; it also protects the server-side check tools of the Toolbox. The token generated in the browser is verified server-side via Siteverify. Success, the expected hostname and the action contact (form), download (download form) or toolbox (check tools) must match. For the security check, Cloudflare processes browser and connection signals: IP address, TLS fingerprint, user agent and the calling website, but not form content. The verification token is valid for five minutes and can only be verified once. Cloudflare does not state a retention period for these signals. According to its own information, Cloudflare additionally uses them as an independent controller to improve bot detection.

The TOMORIS application code does not transmit the form text as Turnstile content. The preview widget and the separate production widget for tomoris.com use separate keys. As long as direct sending is disabled, Turnstile is not loaded in the form; in the Toolbox, it only loads on the pages of server-side check tools, and on the download pages only once you use the form.

08AI assistant

On the AI assistant page and in the AI assistant window, which you open on every page via the icon at the edge of the screen, you can ask questions about the content of this website. The window only loads the assistant and Cloudflare Turnstile when you open it. To answer, our web server searches the public pages of this website for matching sections and transmits your question together with these sections to Anthropic, the provider of the AI model Claude. For follow-up questions, the last up to three questions and answers of the conversation are included. Anthropic generates the answer that is displayed to you. The request is made by our server; we do not transmit your IP address to Anthropic.

Please do not enter any personal or confidential data in the assistant. We only process what you enter in order to answer your question. The application code does not store questions and answers and does not write them to application logs; it only counts how many questions were answered, not answered or rejected. To limit questions to six per minute, we keep a salted hash of your IP address in memory, as with the Toolbox; it is deleted after two minutes at the latest. Before every question, Cloudflare Turnstile protects the assistant against automated abuse (action assistant), as described in the Cloudflare Turnstile section.

Anthropic processes the transmitted content as our processor under Anthropic’s Commercial Terms and Data Processing Addendum. Under these terms, the contracting party for customers in the EEA is Anthropic Ireland, Limited, Ireland. Processing also takes place in the USA by Anthropic, PBC; the transfer is based on the European Commission’s Standard Contractual Clauses, which the Data Processing Addendum incorporates. Under the Commercial Terms, Anthropic does not train models with this content. According to its own information, Anthropic deletes API inputs and outputs within 30 days; content that automated checks flag as a possible violation of the usage policies may be retained by Anthropic for up to two years. Further information can be found in Anthropic’s Commercial Terms, Data Processing Addendum and list of subprocessors.

The conversation history stays in your browser: your browser stores it in the session storage of this tab (tomoris-assistant-verlauf) so that follow-up questions are understood. It is gone when you close the tab or choose “Clear history”. Your browser also stores there where you moved the icon and whether the window is open (tomoris-assistant-fenster), without any content, so that both remain when you change pages. If you choose “Hand over to TOMORIS”, your browser briefly stores the summary of your request in session storage (tomoris-assistant-handoff); the contact form copies it into the message field and deletes the entry immediately. It is only sent to TOMORIS when you submit the form yourself; the section “Contacting us” then applies.

The legal basis is our legitimate interest in answering questions about our content quickly and protecting the service against abuse (Art. 6(1)(f) GDPR); if your question relates to a TOMORIS service, additionally the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). Storing the history and window position in the browser is necessary for the service you have expressly requested (Section 165(3) TKG 2021). Use is voluntary; you can also find all content without the assistant on the linked pages.

The answers are generated by an AI model. They may contain errors and do not replace advice; the linked pages are authoritative. The assistant does not make decisions with legal effect for you.

09Microsoft 365

When direct sending is enabled, the website authenticates server-side via a dedicated single-tenant Entra app with client credentials. Microsoft Graph technically accepts the message and passes it to Microsoft 365 via Exchange Online.

Exchange Online Application RBAC restricts Application Mail.Send to the sending mailbox website@tomoris.com. A positive test for this mailbox and a negative test for a mailbox that is not enabled have been confirmed. The app has no additional tenant-wide Mail.Send permission and no Mail.Read, Mail.ReadWrite, calendar or contact permissions.

10Storage in the browser

The website stores the settings you have expressly chosen in your browser’s local storage:

  • tomoris-theme: light or dark mode
  • tomoris-sound: sounds on or off
  • tomoris-consent-v1: your choice for statistics and ad measurement, valid for 180 days

If you arrive via a Google ad and have not consented to ad measurement, the tab’s session storage additionally holds tomoris-click with the click ID until you close the tab.

These setting values stay on your device and restore your choice on your next visit. Display mode and sound remain stored until you delete the website data; once the consent choice expires, we ask again. You can change or withdraw your consent at any time via “Privacy settings” in the footer.

11Usage statistics

This website records usage anonymously with NEXT.Analytics, a statistics service developed and operated by TOMORIS itself. No cookies are set, no information is stored on your device and no user accounts are recorded. We record the page viewed, the referring page, device type and browser, and certain actions (for example submitting a form or downloads). The IP address is used only briefly to form a daily changing identifier that cannot be traced back, and it is not stored. Individual persons cannot be analyzed. The purpose is to improve our website.

12Statistics and ad measurement

We use Google Analytics 4 and Google Ads from Google Ireland Limited, Ireland, to analyze visits, viewed pages and interactions on tomoris.com and to measure which of our ads lead to a request. We use Google’s advanced consent mode (Consent Mode v2 “advanced”) for this.

Without your consent, we set no analytics or advertising cookies. The Google script is still loaded and sends cookieless signals without a cookie ID: technical browser and device information, the viewed page without form content and the information that no consent has been given. According to Google, these signals are only used in aggregate to estimate missing measurements and not to recognize you. The IP address is processed for the connection; Google states that, for access from the EU, Switzerland or the United Kingdom, individual IP addresses are not logged or stored.

With “Statistics”, you allow Google Analytics cookies such as _ga and _ga_…. With “Ad measurement”, you additionally allow Google Ads cookies such as _gcl_aw and our cookie tm_click, which keeps the click ID of a Google ad for 90 days for the TOMORIS domains. Google Signals and personalized advertising are disabled in our integration.

Click ID and request: If you arrive via a Google ad, the address contains a click ID (gclid, gbraid or wbraid). Without consent to ad measurement, it only stays in the session storage until you close the browser tab. When you submit the contact form, we transmit the click ID with your request to our server and to TOMORIS Commerce, our ordering system. TOMORIS Commerce reports successful requests to Google Ads once a day: click ID, time, type and value of the request and your consent status. Your email address is only included with consent to ad measurement and only as a SHA-256 hash. We never transmit your name, phone number, company or message to Google.

Campaign details: If you send a request from one of our landing pages for ads (addresses under /lp/), the request names the landing page and the campaign details from the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content). Your browser keeps these details in the session storage until you close the tab; they only go to our mailbox with your request, so we can see which ad brought you to us, and not to TOMORIS Commerce. After a request has been accepted, your browser briefly keeps its ID in the session storage so the thank-you page reports the request exactly once as an event; the entry is then deleted.

Measured events: submitted request with a fixed value per service area, completed website or NIS2 check, clicks on phone, email and appointment booking. Form content and check results are never part of an event. A request only counts once our server has confirmed its acceptance.

You can withdraw your consent at any time with effect for the future via “Privacy settings” in the footer; the website then removes accessible Google measurement cookies and tm_click. Withdrawal does not retroactively delete data that has already been lawfully processed.

Google may also process data outside the EU or EEA and bases transfers to the USA on the EU-U.S. Data Privacy Framework. Information about the provider can be found in Google’s privacy policy, in the information on Google Analytics and data protection in the EU and in the explanation of consent mode.

14Legal bases

  • Provision of the website and server logs: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
  • Contact requests: implementation of pre-contractual measures if your request relates to a service (Art. 6(1)(b) GDPR); otherwise legitimate interest in responding (Art. 6(1)(f) GDPR).
  • Sending a requested download: fulfilment of your request (Art. 6(1)(b) GDPR).
  • Being contacted after ticking the box in the download form: your voluntary consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Toolbox check tools: legitimate interest in providing free check tools and protecting them against abuse (Art. 6(1)(f) GDPR).
  • Abuse protection with Cloudflare Turnstile: legitimate interest in protecting the form and the check tools (Art. 6(1)(f) GDPR).
  • Usage statistics with NEXT.Analytics: legitimate interest in improving our own website; the IP address only serves briefly to form the daily changing identifier (Art. 6(1)(f) GDPR).
  • Statistics and ad measurement with cookies: your voluntary consent (Art. 6(1)(a) GDPR and Section 165(3) TKG 2021), which you can withdraw at any time via “Privacy settings”.
  • Cookieless signals and reporting successful requests with a click ID to Google Ads: legitimate interest in measuring whether our advertising works (Art. 6(1)(f) GDPR). Google receives your consent status and does not use the data for advertising without consent. You can object to this processing at any time.
  • Storage of your settings in the browser: necessary to provide a setting and consent choice you have expressly selected (Section 165(3) TKG 2021).

15Recipients and third countries

The following are technically involved: Hostinger for hosting and delivery; Cloudflare for Turnstile and as the DNS resolver for the DNSSEC check of the DNS security check; Microsoft Entra, Microsoft Graph and Exchange Online for authentication and message handover, Microsoft Entra also for the tenant lookup of the Microsoft 365 domain check; Microsoft, with the web service endpoints.office.com, for the list of Microsoft 365 endpoints; and Sectigo, as operator of crt.sh, for the certificate transparency check. Google is involved in statistics and ad measurement, without consent only with cookieless signals. TOMORIS Commerce (operated by TOMORIS on its own servers) receives click IDs of successful requests and reports them to Google Ads. TOMORIS processes requests in the designated Microsoft 365 mailbox. NEXT.Analytics is operated by TOMORIS itself on its own servers in Austria; requests to it pass through Cloudflare as named above. Unconfirmed details on contracts, subcontractors or regions are not presented here as fact.

Cloudflare and Microsoft are companies headquartered in the USA, so processing outside the EU or EEA cannot be ruled out. According to their own information, these providers base such transfers on the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses. Processing outside the EU or EEA also cannot be ruled out for Sectigo as the operator of crt.sh. For Google, please also refer to the provider information linked above.

For the AI assistant, Anthropic is additionally involved as a processor (Anthropic Ireland, Limited, Ireland, and Anthropic, PBC, USA). The transfer to the USA is based on the European Commission’s Standard Contractual Clauses; details are in the AI assistant section.

16Retention period

The website code does not maintain its own contact database. We store requests in the TOMORIS Microsoft 365 mailbox and delete them once they have been dealt with, unless statutory retention obligations apply. If a request leads to a business transaction, we keep the correspondence as business correspondence under Section 212 UGB for seven years from the end of the calendar year in which it was received.

For addresses from the download form, the section on downloads by email applies. For server logs at Hostinger and Turnstile signals at Cloudflare, the information in the sections on hosting and Cloudflare Turnstile applies; for input in check tools, the Toolbox section applies.

17Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). To exercise these rights, please contact contact@tomoris.com.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

No automated decision-making, including profiling, takes place on this website.

18Security and updates

The forms use server-side field and origin checks, a body limit, timeouts and Turnstile. The contact form sends to fixed sending targets, the download form to the address entered, limited per sender and per recipient. Credentials and tokens remain server-side and are never output in the browser. Transmission is encrypted via HTTPS.

This policy is updated when provider information or the actual data flows change.

Status of this policy: November 2026