A secure website, ready for GDPR. Hosted in the EU.

Nobody thinks about security. Until a login leaks.

A small business website is often run on one shared password, a plugin nobody has updated in a year and a contact form that sends customer details around in plain email. Then a password leaks, or a customer asks what you store about them, and nobody has the answer.

What makes a website secure?

Three things: only the right people can get in, you can see what they did, and the site itself has as little as possible that can be attacked. Striive handles all three for you, on every site.

Signing in is protected

Every person has their own login, and the login is hard to guess and hard to misuse.

• Two-factor sign-in with an authenticator app, plus ten one-time backup codes.
• Passwords are stored with Argon2id, a one-way method. Nobody at Striive can read yours.
• After five wrong attempts, the account is locked for a while, and the wait grows each time.
• Before risky actions, such as removing a user or signing out every device, Striive asks for your password again.
• Each person sees where they are signed in and can sign out other devices.

An activity log shows who did what

Sign-ins, failed attempts, new and removed users, changed roles, published pages and edited content are logged with who did it and when. When something changes that shouldn’t have, you can see who did it, instead of guessing.

Less on your website that can be attacked

Your published website is plain HTML and CSS. There are no plugins to update and no database a visitor can reach. The login isn’t on your own domain, so nobody can try passwords on yourbusiness.dk/admin.

• HTTPS on every page, set up and renewed for you.
• Each page tells the browser which scripts it may run, so injected code is refused.
• Images and fonts are served from your own site, not pulled in from other servers.

GDPR: what Striive does for you

Striive is a Danish business, and your website and its data are hosted on Google Cloud in Stockholm, inside the EU. A data processing agreement is part of the terms, and it lists every sub-processor.

• The cookie banner blocks statistics, marketing and YouTube videos until the visitor says yes, and rejecting is as easy as accepting.
• Each consent is recorded without IP addresses, so you can document it. You can export the records.
• Google Fonts are downloaded to your site, so a visitor’s browser never contacts Google for a font.
• Contact form replies are stored in Striive. The email telling you about a new reply doesn’t contain what the person wrote.

What it doesn’t do

GDPR still applies to you. You are responsible for your website’s privacy policy and for what you collect, and a cookie banner doesn’t make a site compliant on its own.

Striive has no ISO 27001 or SOC 2 certification. Two-factor sign-in is something each person turns on for their own account, and there’s no single sign-on or passkeys. Some services run outside the EU: emails are sent through Resend, which keeps its logs in the United States, and when you use the AI assistant, the content you work on goes to the AI provider that answers. Our privacy policy and data processing agreement say exactly where.