Security

Website

• The connection is always encrypted (HTTPS with TLS 1.2 and 1.3; the server refuses older versions). Your browser remembers that the site may only be opened securely (HSTS).
• Current versions of common browsers agree with the site on the hybrid key exchange X25519MLKEM768, which combines the classical X25519 algorithm with the post-quantum ML-KEM (NIST standard FIPS 203). This protects against a connection being recorded today and decrypted later with a quantum computer.
• The site loads only its own files. It uses no third-party scripts, fonts or services, and its content rules (Content Security Policy) forbid the browser to run anything else.
• The site is static: no PHP or other server-side code runs on it. The server only accepts requests to read pages and refuses submitted data and requests for scripts.
• The site cannot be embedded in another page, and other pages cannot embed its photos or videos either. It has no access to the camera, microphone or location.
• It uses no cookies and no analytics or tracking tools. When you follow a link to another site, your browser does not tell it that you came from us.
• The contact form sends nothing through the website: it prepares the message in your own e-mail program, so nothing is stored on the server. The e-mail address is protected against automated harvesting in the page code.
• An automated check verifies the site’s files, certificates and DNS records every day. A change we did not make triggers an alert.

Domains and e-mail

• The alfagroup.eu and alfagroup.sk domains are protected by DNSSEC signatures, and only a designated certification authority may issue certificates for them (CAA).
• Outgoing mail is digitally signed (DKIM) and can be verified under the SPF and DMARC rules. Receiving servers reject e-mail that merely pretends to come from us, or file it as junk.
• The group writes only from @alfagroup.eu addresses. E-mail from an @alfagroup.sk address does not come from us.
• Sending servers that support MTA-STS (Gmail, for example) deliver mail to @alfagroup.eu addresses only over an encrypted connection and only to a mail server with a valid certificate.
• Messages to info [at] alfagroup.eu and security [at] alfagroup.eu can be encrypted with our public PGP key (fingerprint 02D8 A225 F600 22B1 9C74 9AA6 28FE C300 3681 4039, valid until 10 October 2028). The key is on this website and on the keys.openpgp.org server. Mail clients that support Web Key Directory (such as GnuPG, Thunderbird or Proton Mail) also find it on the alfagroup.eu domain on their own.

• Public PGP key – file on this website
• keys.openpgp.org – the same key on the public server

Verify it yourself

You can run the independent tests at any time; they show the current state:

• Mozilla HTTP Observatory – website security settings
• Security Headers – security headers
• SSL Labs – encrypted connection, including the post-quantum key exchange
• Internet.nl – modern internet standards

Reporting a security flaw

If you find a flaw in the security of the website, the domains or the mail, please write to security [at] alfagroup.eu. The contact is also given in the standard security.txt file. You can encrypt your report with our PGP key. The security.txt file is signed with it.

These rules apply when you verify and report a flaw:

• They cover www.alfagroup.eu, alfagroup.eu, alfagroup.sk and mta-sts.alfagroup.eu, and mail for the alfagroup.eu and alfagroup.sk domains.
• They do not cover the services of our hosting provider, WebSupport s.r.o., such as its webmail. Please report those to the provider at security [at] websupport.sk.
• Do not overload the server, use social engineering, access other people’s data or change anything on the server. Use the smallest test that proves the flaw.
• We assess every report. We confirm receipt within three working days and keep you informed of the next steps.
• Please do not make the flaw public until we have fixed it or agreed otherwise with you.
• We will not take legal action against anyone who acts in good faith and within these rules.
• We do not pay rewards for reports.

• security.txt

Sensitive information

Do not send classified information by e-mail or through the form, not even encrypted. Send other sensitive information encrypted with our public PGP key, or get in touch and we will agree on another way of communicating.