Technical audit · 2026-05-29

helmholtz.de

Germany's Largest Research Organization

Germany's largest research organization — 18 centers, 43,000 employees. 15 requests, 1 domain. TYPO3, nginx. HelmholtzHalvar — a proprietary corporate typeface, served locally. No external services whatsoever. Matomo is declared as activating only after consent. Set-Cookie — zero. Full compliance.

Timeline of the leak

+0 ms · homepage
www.helmholtz.de/ — HTML, nginx, TYPO3. TYPO3 SFC cache tags in the response headers (tx_news_pid_*) — server-side news cache invalidation.
+118 ms · styles and images
TYPO3-merged CSS from typo3temp/assets/compressed/ — local. News content images (webp) — from assets/, local.
+132 ms · font
HelmholtzHalvarMittel-Rg.woff2 — Helmholtz-Gemeinschaft's own corporate typeface, from _assets/, local. No Google Fonts, no Adobe Fonts.
+163 ms · manifest and icons
manifest.json, favicon.ico, icon-32x32, icon-144x144 — local.

Declared versus actual

Matomo — mentioned in the policy as web analytics activated only after user consent — заявлен

Context

Helmholtz-Gemeinschaft Deutscher Forschungszentren is Germany’s largest research organization, bringing together 18 national centers — from DESY and GSI to Forschungszentrum Jülich and Helmholtz-Zentrum Berlin. Funding is predominantly federal and state-level. TYPO3, nginx. HAR: 15 requests, 1 domain.

HelmholtzHalvar — a corporate typeface, local

Helmholtz-Gemeinschaft uses its own HelmholtzHalvar typeface (Mittel Regular weight) — a woff2 file from the local _assets/ directory. Halvar is a typeface family by German type designer Jan Michael Casamento (Studio MASA), adapted and renamed for Helmholtz. No Google Fonts, no Adobe Fonts.

No external services — at all

All 15 requests go to www.helmholtz.de. No CDN, no analytics, no CMP platform, no social plugins. The TYPO3 SFC tags in the response header (tx_news_pid_*) are a server-side cache invalidation mechanism, transmitting no data to third parties.

The privacy policy states directly: “Wir setzen ohne Ihre Entscheidung standardmäßig keine Cookies auf unserer Webseite ein. Ausschließlich nach Ihrem Einverständnis verarbeiten wir anonyme Daten (Webanalyse durch Matomo).” Matomo activates only after explicit consent. There are no requests to Matomo in the HAR. Set-Cookie — zero.

Conclusion

www.helmholtz.de — one domain, a proprietary typeface, no external services, Matomo strictly behind the consent barrier. No GDPR violations recorded at the time of the audit.

Evidence
Original (audit)
HAR file: de/helmholtz-de-2026-05-29.har
SHA-256: a69a326cd6390122a19998865dea6bc9e5a7f3e743cd71b6bc3bad8ca2d7cdce
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.