Legends Live Forever LLC, CORE Navigator (website www.core-navigator.com)
Extract, as of 28 October 2026
This extract lists only measures we have checked in code, in configuration or live. We provide the full version on request.
| Measure |
| Server in a data centre in Frankfurt am Main, operated via Laravel VPS on DigitalOcean infrastructure |
| Measure |
| Firewall: only SSH (22), HTTP (80) and HTTPS (443) open from outside |
| Test and stage environments behind password protection |
| Measure |
| Production service starts only with allowed configuration keys; secrets only in the server environment file |
| Measure |
| Cookie banner consent record without IP, URL or user agent, identifier stored only as HMAC |
| Forms: the server does not pass the IP address to ActiveCampaign |
| Before any third-party script, click identifiers and all parameters except campaign details are removed from the address |
| Analytics and advertising events only with allowed parameters, never form content |
| Measure |
| Encrypted connection (TLS 1.3), HTTP redirects to HTTPS |
HSTS (1 year), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy |
| Form data goes from the server to ActiveCampaign over HTTPS, not from the browser (new forms) |
| Measure |
| Form endpoint: origin check, 8 kB limit, strict schemas, honeypot |
| Consent stored with text version and timestamp |
| Measure |
| Rate limits on the consent and survey endpoints |
| Releases with automatic gate, smoke test and rollback |
| Measure |
| Privacy policy built from versioned blocks; build fails on mismatch with the record of processing |
| Record of processing (Art. 30) versioned in its own repository, reviewed per change |
| Privacy log with follow-up dates, weekly review |
