Danish forms routinely ask for a personal identification number. It identifies one individual for life, and most WordPress form plugins will happily email it in plain text.
A Danish form asking for a CPR number is holding something far more consequential than a name and an email address.
A CPR number cannot be reissued or rotated. Where a form collects one it is stored encrypted rather than emailed as readable text through mail servers nobody audited.
Identifiers passed in a URL land in access logs, referrer headers and analytics. Query strings are scrubbed before writing, and forms are set to post rather than get.
Site, backups and logs stay inside the EU and we will name the location, which Danish public sector buyers ask for early.
A form submission holding an identifier should not sit in a database indefinitely. Retention is a decision with a date rather than a default of forever.
Denmark is small and densely connected, so a nearby origin costs nothing and a distant one costs latency on every uncached request.
Most form plugins deliver submissions as plain-text email. For a contact message that is untidy. For a national identification number it is a disclosure with no expiry.
A Danish site is easy to make fast. What takes attention is one form field that most plugins treat exactly like a name.
Most of this exists because of one field that a generic form plugin has no special handling for.
| Setting | What we do | Why |
|---|---|---|
| Identifier storage | CPR and similar numbers encrypted at rest, not emailed as text | A national identification number cannot be reissued, so a single plain-text copy in a mail spool is a permanent exposure rather than a resettable one. |
| URL handling | Sensitive values posted rather than passed as query strings | Anything in a URL is written to access logs, sent in referrer headers and captured by analytics, none of which were designed to hold it. |
| Log scrubbing | Query strings and POST fields removed before writing | Logs are the copy nobody remembers, and they persist for months after the submission itself was handled. |
| Retention window | Given an explicit date rather than left indefinite | A submission holding a lifelong identifier accumulates risk for as long as it is kept, and the default is to keep it forever. |
| Origin placement | EU, close to the Danish market | The country is compact and well connected, so latency and residency are answered by the same nearby origin. |
Every plan includes free migration, daily backups, SSL and 24/7 support.
Move the site across — migration is free, form handling reviewed.