Technical audit · 2026-05-26

vfgh.gv.at

Austrian Constitutional Court

Austrian Constitutional Court — 20 requests, 2 domains. The external one, apps.mindbreeze.com, an Austrian search engine: 2 CSS files for the widget, zero data, zero cookies. YouTube and Twitter are declared in the policy with double click-to-load.

Timeline of the leak

+685 ms · load
18 requests to www.vfgh.gv.at — CSS, JS, fonts, images. Two requests to apps.mindbreeze.com — search-widget styles only.
Session total
Zero cookies, zero trackers, zero data sent to external services. Neither YouTube nor Twitter appeared in the HAR.

Declared versus actual

Mindbreeze — mentioned in the policy as the search processor, Art. 6(1)(a) and (f) — declared
YouTube — double click-to-load, data goes out only on click — declared
Twitter/X — double click-to-load, likewise — declared
Webalizer — server-side analytics with IP pseudonymization (the last 3 octets are truncated) — declared

Transfer timings

+685 ms apps.mindbreeze.com

Two CSS files for the search widget. Zero user data, zero cookies.

Context

VfGH (Verfassungsgerichtshof) is Austria’s Constitutional Court, the highest body of constitutional review. HAR: 20 requests, 2 domains. The privacy policy is detailed, covering both judicial and non-judicial activities, and a DPO is appointed.

The only external domain is apps.mindbreeze.com. Mindbreeze is an Austrian company providing enterprise search solutions. Two requests per session, both for search-widget CSS files: zero user data, zero cookies. The privacy policy explicitly mentions Mindbreeze as the processor when the search function is used.

YouTube and Twitter — click only

YouTube videos and Twitter posts are embedded via double click-to-load: previews are stored on the court’s own server, and a connection to the external service is only established when the user actively clicks. Neither YouTube nor Twitter appeared in the HAR. The policy describes this explicitly and correctly.

Server-side analytics with no external services

Web analytics run on Webalizer — a server-side tool with no external requests. IP addresses are truncated to remove the last three octets before analysis, ruling out personal identification. No Google Analytics, no counters.

Conclusion

20 requests, 2 domains — and the second domain carries only stylesheets, not a single byte of user data. The Constitutional Court has documented everything correctly and implemented it the same way.

Evidence
Original (audit)
HAR file: at/vfgh-gv-at-2026-05-26.har
SHA-256: 985c47a16f346c716ba2d916c380f313d6b7dc858ccec4f810833b8359843be9
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.