Release
This site loads nothing from anyone else
No third-party scripts, fonts, analytics or CDN resources — enforced by a content security policy rather than promised in a privacy page.
Reading a page on this site sends requests to this site and to nothing else.
No analytics. No tag manager. No hosted fonts. No assets from anyone else’s servers. No embedded widgets. No session replay. Nothing on the page reports your visit to anyone.
One party besides us handles your request: the network provider that delivers this site, Cloudflare, which terminates the connection before passing it to our server. It is listed with what it can see on the privacy page, among the sub-processors.
Why it is worth saying
The audience for this site includes people evaluating whether to hand over an address book. For them, “which institution is looking at enforcement tooling” is itself commercially sensitive information — and a hosted font stylesheet is enough to leak it to a third party.
Most sites in this category state a privacy position and then load six external hosts. The claim and the network tab disagree, and the network tab is the one that is true.
How it is enforced
The typefaces are self-hosted and served from the same origin as everything else. There is no analytics code to remove because none was ever added.
The claim is backed by a content security policy that permits 'self' and nothing else —
so if someone later adds an external resource by accident, the page breaks visibly instead
of the resource loading quietly. The build also fails if the compiled output references any
host other than the site’s own.
A commitment that only holds while everyone remembers it is not a commitment. This one is checked by a machine on every build.
How to verify it
Open developer tools, load any page, and read the network panel. Every request should be to this site’s own host. If you find one that is not, that is a bug and we would like to hear about it — the security page has the address.
Updated 2026-10-27: the site moved to 4shock.xyz and is now delivered through Cloudflare’s network. The page still loads only from its own host; the provider that carries the connection is named on the privacy page.