finanzonline.bmf.gv.at

Context

FinanzOnline is Austria’s state portal for filing tax returns, viewing tax assessments, and interacting with tax authorities. One of Austria’s most-visited government services — used by citizens, businesses, and accountants. Operator: Bundesministerium für Finanzen (BMF). HAR: 30 requests, 2 domains. Session on the login page.

Two domains — both bmf.gv.at

finanzonline.bmf.gv.at and chat.bmf.gv.at — both subdomains of Austria’s Federal Ministry of Finance. The chat widget is hosted on BMF’s own infrastructure, rather than through Intercom, Zendesk, or another external service. Data does not leave the state infrastructure.

CSP with nonce — a high security standard

Content-Security-Policy: default-src 'self'; script-src 'self' chat.bmf.gv.at secure.oesterreich.gv.at sso.finanzonline.bmf.gv.at 'nonce-...'

A policy with a nonce means every script must carry the corresponding one-time token — protection against XSS beyond a standard CSP. secure.oesterreich.gv.at is Austria’s state SSO portal (ID Austria). sso.finanzonline.bmf.gv.at is the portal’s own SSO.

Policy — detailed, BMF group

The Datenschutzerklärung covers Austria’s entire tax authority (Finanzressort). A detailed table of contents: legal bases, categories of data, recipients, retention periods, automated decisions, security. The DPO for the Finanzressort has a dedicated contact. The controller is BMF.

Sensitivity context

FinanzOnline processes tax data — one of the most sensitive categories of financial information for citizens and businesses. The absence of any external trackers on the login portal is the mandatory minimum for a service of this level.

Conclusion

30 requests, 2 domains of state infrastructure, CSP with a nonce, HSTS. Austria’s tax portal upholds a standard commensurate with the sensitivity of the data it processes. Alongside dsb.gv.at, a-sit.at, and ages.at, it is the fourth Austrian government site with a zero external-request profile.