Firm Foundation check

How strong is your digital foundation?

Have your website and domain inspected, then respond to 12 short statements. Get practical recommendations for security, customer data and AI use.

What do we check?

Around 4–6 minutes No account needed

Your website and domain

Company information, services, forms and DNS

12 relatable statements

From passwords to customer data and AI

Recommendations you can act on

With a first step and a concrete outcome

Firm Foundation

Start with your website address.

We collect information visible on your public website and in DNS. The questionnaire then opens automatically. Findings appear in your recommendations.

For example company.nl or https://www.company.nl. We start at the homepage; pasted paths and queries are not sent on. DNS checks use the domain without www.

Enter a DKIM selector (optional)

For example selector1 or google. Ask your mail administrator; a random selector says nothing about other keys.

We read up to four public pages and query website and email settings via Cloudflare. Your answers stay here until you request the report by email. We do not use AI.

Save your answers as a file to continue later. “Email my report” stores your report in the TovoT Portal.

From an initial check to a workable plan.

Your website and domain

We read public website pages and DNS records: from company information, forms and external services to DMARC and SPF. You see the sources and what remains uncertain.

12 relatable statements

About access, recovery, customer data and AI. Five consistent choices, with “I do not know” separate. No technical expertise needed.

Recommendations you can act on

See what to do first, who can help and the intended outcome. You can also receive the report by email, with a shareable link and an option to save a PDF.

Good to know before starting

Is this a security audit?

No. The check combines limited website and DNS observations with your self-assessment. It is a starting point for targeted review, not certification or a guarantee.

Do I need to replace my IT provider?

No. Start with the services already provided and ask for evidence. Address demonstrated gaps and compare providers only on a clear scope.

Where does my data go?

While completing the check, your answers stay in this browser. Our server reads up to four public pages and queries settings via Cloudflare. If you request the report by email, your check and answers are sent to the TovoT Portal and Brevo emails a link valid for 30 days. Anyone with the link can read the report. TovoT administrators can access the stored report; request deletion via [email protected]. We do not use AI or subscribe you to marketing.

Sources and method: NCSC · AP · DMARC (RFC 9989)

Firm Foundation