Open standard · Draft v0.1
Privacy you can actually see.
Our scanner measures from the outside which third-party services Swiss websites embed. Organisations place their own machine-readable declaration alongside – public, verifiable, comparable. Promise and measurement become a card any customer reads in ten seconds and any tool can check automatically.
One website declares so far – our own. Yours will be the second →
And the fact that 53 of the measured websites voluntarily publish a
security.txt shows that /.well-known/ conventions do get adopted
once the benefit is plain.
The register
Measured before anyone asks
Our scanner measures Swiss websites from the outside and records which third-party services are statically embedded. The result is a public profile for every website – no sign-up, no fee, no rating. The measurement executes no JavaScript; every finding is a lower bound, never a complete list.
An organisation that wants to add its own side of the story publishes a declaration on its own domain. The scanner runs weekly – after the next run, the declaration appears in the register. Nobody has to register with us for that.
What the measurements show
The state of play, in numbers, without names
The industry report aggregates all measurements – by sector, never naming individual organisations. It rebuilds itself whenever new measurements arrive and may be reused freely with attribution.
Three levels of trust
How measurement becomes trust
Measured
An outside scan with open methodology and a date. Requires no cooperation from the organisation.
Declared
The organisation publishes its own machine-readable file on its own domain. Public – and therefore binding under Swiss unfair-competition law.
Verified
Audited by independent third parties – deliberately not by this register. The register makes things visible; it does not judge.
For your organisation
Why declare?
Verifiable trust
"We take privacy seriously" is written on every website. The declaration is the version of that sentence any customer and any tool can actually verify.
Pre-empt the questionnaires
Procurement offices, enterprise customers and principals increasingly ask about data flows and sub-processors. One URL answers the questionnaire before it arrives.
Your own website, under control
The public comparison of measured ↔ declared shows when a service appears on your website that nobody ever decided on – before someone else notices.
And yes: declaring publicly means committing yourself. That is exactly what makes a declaration more credible than any marketing sentence – a signal that costs nothing is not a signal.
The obvious objection
Why should this succeed where P3P failed?
The W3C let websites declare their data practices machine-readably back in 2002 – P3P failed because almost no software consumed the statements and copied courtesy policies carried no consequences. This standard therefore starts from the other end: the scanner measures without any cooperation from the organisations, so the register is useful from day one – and every declaration is publicly mirrored against the measurement. A copied declaration shows up in the measurement.
The full discussion of P3P, the W3C Data Privacy Vocabulary and the app-store privacy manifests is in the specification on GitHub →
Us first
This website declares itself
Whoever demands transparency should declare first. Our own declaration sits exactly where this standard says it belongs – and it is deliberately short: no third parties, no cookies, no JavaScript, no access logs.
For organisations
Declare your own data flows
The generator walks you through every required question and produces your finished
datenfluss.json – with templates for the most common setups, a catalogue of
widely used services, and checks against the Swiss third-country rules. Your input never
leaves your browser.
Create a declaration (currently in German) →
The specification, validator,
renderer and scanner are open and free of charge – MIT for the code, CC BY 4.0 for the
specification. The standard's field names are German by design, like robots.txt
is English by design; an English field reference is part of the specification repository.
Everything on GitHub →
Prefer doing it together? We are looking for ten pilot companies – one hour, free of charge. Offer and pricing →