Security Policy

Futunk is a European alternative for activity tracking, performance insights and social interaction, founded by a fellow runner. We're privacy-first, tracking-free and ad-free.

Established in Rotterdam (The Netherlands), Futunk Labs is registered with the Dutch Chamber of Commerce (KvK) under number 97036250 and VAT ID NL005245317B83.

At Futunk, your privacy and safety come first. We've taken dedicated measures to ensure the security of both the website and its hosting server.

Best Practices Practised

Server

• Up-to-date software packages
• SSH access by key only
• Firewall with aggressive fail2ban rules

DNS

• DNSSEC
• Transport Layer Security Authentication (TLSA)

E-mail

• Sender Policy Framework (SPF)
• Domain Message Authentication Reporting (DMARC)
• Domain Keys Identified Mail (DKIM)

Web Server

• Content Security Policy (CSP)
• Secure/Same-Site encrypted cookies (SHA256)
• HTTP Strict Transport Security (HSTS), included in Chrome's HTSTS preload list
• Subresource Integrity (SRI)

Website

• Uploads and software resources not in public document root
• User input validation/sanitisation, SQL injection prevention, user content output sanitisation

Authentication

• Encrypted passwords (SHA512) including salt and pepper to prevent rainbow table attacks

Test Results

Results are valid as of 7 September 2026.

• 100% score on Internet.nl Website test
• A+ score on SSL Labs Server Test
• A+ score on Mozilla Observatory
• A+ score on ImmuniWeb (PCI DSS and GDPR compliant)
• 0.0 Severity score in OpenVAS Vulnerability Assessment Scanner

Community

Futunk contributes to a safer internet by reporting suspicious activity to AbuseIPDB. Our reporting includes:

• Bots detected by login, signup and comment forms on the website
• Unauthorised SSH login attempts