bundesverfassungsgericht.de

German Federal Constitutional Court. 18 requests, 1 domain. GSB platform, ITZBund, Apache. AkkoPaneuropean and Sabon LT Pro — corporate typefaces, served locally. An extremely strict CSP with a sha256 hash, self only. No analytics, no banner, no trackers. ITZBund declared. Set-Cookie — zero. Full compliance.

Context

Bundesverfassungsgericht is Germany’s constitutional review body, based in Karlsruhe. It hears complaints of violations of constitutional rights, disputes between branches of government, and reviews the constitutionality of laws. Sensitivity is high. GSB platform, Apache, ITZBund. HAR: 18 requests, 1 domain.

The strictest CSP in the German series

The Content-Security-Policy uses default-src 'self' with a sha256 hash for the single inline script ('sha256-TSvMvR1KhNSMgA0cXCcbJuroB+o1McSEH4wxscOg1hc='). connect-src and media-src permit only 'self' and multimedia.gsb.bund.de. frame-src 'self', frame-ancestors 'self', form-action 'self'. block-all-mixed-content and upgrade-insecure-requests. No external domain is permitted for scripts or data — this is the most restrictive CSP among all sites in the German series.

AkkoPaneuropean and Sabon LT Pro — corporate typefaces

BVerfG uses two licensed typeface families: AkkoPaneuropean (Light, LightItalic, Medium) — a humanist sans-serif from the Akkurat foundry, and SabonLTW05-Bold — the classical serif Sabon by Jan Tschichold. Both in woff format from /static/fonts/, local. No Google Fonts.

ITZBund — declared as the data processor

The policy explicitly names ITZBund as the data processor (Auftragsverarbeiter, Art. 28 DSGVO) and links to ITZBund’s privacy policy. Processing is confined to servers in Germany.

X and YouTube — external channels only

The policy describes X and YouTube exclusively as the court’s external social channels. It states explicitly that users cannot reply to posts or send direct messages — no interactive SDKs are embedded on the site. There are no requests to Twitter or Google in the HAR.

Conclusion

www.bundesverfassungsgericht.de is an exemplary minimal technical stack for a state body of the highest jurisdiction: one domain, 18 requests, an extremely strict CSP, corporate typefaces served locally, no analytics, and ITZBund declared. No GDPR violations recorded at the time of the audit.