We show everything. You don't have to trust us blindly.

You're moving a critical part of your stack here — that deserves full insight. Here's what we show every day without you having to ask.

1. Live numbers — right now

The numbers below are pulled from the production database on every visit. No marketing rounding, no static figures from 2023.

Verify yourself: curl https://api.danadresse.dk/api/v1/stats

2. Speed — measured, not claimed

Comparison of median response time (p50) against DAWA's own live endpoints on identical queries. Lower = faster.

Measured 14 June 2026 from a developer client — not from our own server (that would remove the network and be dishonest). n = 25 warm requests per endpoint, against DAWA's live API while it was still running (DAWA shuts down 17 August 2026). Numbers vary with the network: on autocomplete, full-text search and lookup we are consistently faster; reverse geocoding is on par with DAWA. The measurement tool is open — tests/benchmark/api_bench.py — run it yourself.

3. The source code is open

Everything that isn't a business secret (API-key hashing pepper, customer data, billing secrets) is public on GitHub. Yes, that means you can audit how we parse DAWA responses, how we hash your keys, and which logs we keep.

4. Real-time operational status

We maintain a status page with uptime for the last 90 days. Incidents are logged openly incl. root cause and postmortem.

👉 See status.danadresse.dk

5. Our data sources — all public

Dataset	Source	Licence	Frequency
DAR — addresses	Klimadatastyrelsen (SDFI)	CC BY 4.0	15 min
DAGI — parish, police district…	SDFI / GeoDanmark	CC BY 4.0	Daily
BBR — buildings	Datafordeler (BBR) · GraphQL	Free (public)	Live — 6.2M buildings
Postcodes	PostNord + SDFI	Free	Monthly
Municipalities & regions	Ministry of the Interior	Public domain	Rare

6. Security — what we do

• API keys are hashed. We store SHA-256(key + pepper) + the last 4 digits. Even I as the developer can't read a key. You see it once at creation — after that it's gone.
• Passwords via bcrypt. Cost 12. Never any plaintext.
• OTP codes hashed. The 6-digit code is stored as SHA-256, max 5 attempts, 15 min TTL.
• HTTPS everywhere. TLS 1.3, HSTS preload, no mixed content. Wildcard SSL via acme.sh + Let's Encrypt.
• Short-lived JWT. 24 hours. Dashboard cookies are HttpOnly + Secure + SameSite=Lax.
• Rate limit per key. Redis token bucket. Stops brute force + abuse.
• EU data residency. Servers in Germany. No communication leaves the EU.
• Encrypted backups. Daily backups, AES-256, kept 30 days.

7. What we don't do

• We don't sell your data. Not to ad networks. Not to data brokers. Not to CVR-ranking services.
• We have no third-party trackers. No Google Analytics. No Facebook Pixel. No Hotjar.
• We don't read the content of your requests. We log methods, paths, timing — not the body.
• We send no marketing emails without explicit double opt-in. You can turn off all emails in the dashboard.

8. If you find a bug or vulnerability

We have a responsible disclosure program. Write directly to security@lynbro.dk (PGP key on keys.openpgp.org). We reply within 48 hours and credit you if you'd like.

9. If we go down tomorrow

The whole system is open source. If Danadresse disappears you can clone the repo, deploy to a VPS and carry on. Our deployment config + alembic migrations + Meili config are all there.

We also have a data-portability export in the dashboard — you can download all your API keys, usage statistics and invoices as JSON or CSV at any time.