# Media attributions

## Images and graphics

This site uses **no third-party images**. There are no company logos, no
screenshots of vendor websites, no stock photography and no author portraits.

Every graphic is original to this project:

- `favicon.svg` and `favicon-32.png` — original mark drawn for this site: an
  open perimeter with a position outside it. The PNG is generated
  programmatically; see the build notes in `README.md`.
- All inline icons (checkmarks, the information and warning glyphs, the
  navigation menu icon) are original inline SVG paths written for this site.
- The criteria list, evidence chips, stage sequence and comparison tables are
  built with CSS and semantic HTML. No image assets are involved, and every
  graphic element has a text equivalent in the markup.

Company names, brand names and programme names (DESC, Cyber Force, CREST,
OWASP, NIST, PTES and the names of profiled providers) are the property of their
respective owners and appear here only to identify the services and standards
being discussed. Their appearance implies no affiliation, sponsorship or
endorsement in either direction.

## Typefaces

Both families are self-hosted from this domain (latin subset, `.woff2`) rather
than loaded from a font CDN, so page views do not disclose visitor IP addresses
to a third party.

| Family | Use | Licence |
|---|---|---|
| Archivo (variable, weight + width axes) | Display headings, logo, figures | SIL Open Font License 1.1 |
| IBM Plex Sans (variable) | Body text | SIL Open Font License 1.1 |
| IBM Plex Mono | Registry chips, dates, data | SIL Open Font License 1.1 |

The SIL Open Font License permits use, modification and redistribution,
including for commercial purposes, and does not require visible attribution on
the page. This file records the attribution regardless.

## Reference material

`images/reference.png` is a private design reference used during development.
It is not published on the site, is not linked from any page, and no part of it
is reproduced in the output.