{
  "schema": "ecomark-automated-analysis-v4",
  "generated_at": "2026-08-30T12:50:07.970Z",
  "algorithm": {
    "version": "4",
    "status": "current",
    "name": "EcoMark v4",
    "published": "2026-08-28",
    "rubric": {
      "0": "Fails materially or creates clear harm in this criterion.",
      "1": "Poor. Significant problems or unnecessary impact remain.",
      "2": "Mixed. Some good practice is present, but material gaps remain.",
      "3": "Good. The criterion is mostly met with only limited gaps.",
      "4": "Strong. The criterion is deliberately and consistently met."
    },
    "formula": {
      "criterion": "criterion_points = max_points × level ÷ 4",
      "category": "category_score = sum(criterion_points)",
      "overall": "overall_score = round(sum(category_score × category_weight))",
      "ranking": "competition ranking: equal scores share a rank and the next rank skips accordingly (1, 1, 3)",
      "comparison": "rankings compare assessments produced by the same EcoMark version only",
      "historical_cutoff": "historical rankings use published_at, not assessed_on"
    },
    "analysis": {
      "type": "automated-observable-web",
      "rendered_homepage": true,
      "max_pages": 5,
      "max_policy_pages": 8,
      "max_asset_samples": 16,
      "freshness_hours": 24,
      "dns_record_types": [
        "A",
        "AAAA",
        "CNAME",
        "MX",
        "NS",
        "TXT"
      ],
      "green_web_check": true,
      "rules": {
        "efficiency": {
          "payload": {
            "metric": "average_page_kb",
            "direction": "lower",
            "bands": [
              500,
              1000,
              2000,
              4000
            ],
            "unit": "KB/page"
          },
          "javascript": {
            "metric": "average_javascript_kb",
            "direction": "lower",
            "bands": [
              100,
              250,
              500,
              1000
            ],
            "unit": "KB/page"
          },
          "requests": {
            "metric": "average_resource_references",
            "direction": "lower",
            "bands": [
              20,
              40,
              70,
              100
            ],
            "unit": "resources/page"
          },
          "media": {
            "metric": "media_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "issues"
          },
          "caching": {
            "metric": "cacheable_asset_percent",
            "direction": "higher",
            "bands": [
              80,
              60,
              40,
              20
            ],
            "unit": "%"
          }
        },
        "privacy": {
          "trackers": {
            "metric": "tracker_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "known trackers"
          },
          "analytics": {
            "metric": "analytics_risk",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              3
            ],
            "unit": "risk level"
          },
          "cookies": {
            "metric": "nonessential_cookie_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "response cookies"
          },
          "third_party_data": {
            "metric": "third_party_percent",
            "direction": "lower",
            "bands": [
              0,
              10,
              25,
              50
            ],
            "unit": "%"
          },
          "invasive_techniques": {
            "metric": "invasive_tracker_count",
            "direction": "lower",
            "bands": [
              0,
              0,
              0,
              1
            ],
            "unit": "known invasive tools"
          }
        },
        "sovereignty": {
          "provider_jurisdiction": {
            "metric": "us_provider_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "visitor-facing provider ecosystems"
          },
          "data_location": {
            "metric": "known_non_eu_data_percent",
            "direction": "lower",
            "bands": [
              0,
              10,
              30,
              60
            ],
            "unit": "%"
          },
          "portability": {
            "metric": "proprietary_embed_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "embeds"
          },
          "concentration": {
            "metric": "top_provider_share_percent",
            "direction": "lower",
            "bands": [
              0,
              40,
              65,
              85
            ],
            "unit": "%"
          },
          "openness": {
            "metric": "open_technology_score",
            "direction": "higher",
            "bands": [
              90,
              75,
              60,
              40
            ],
            "unit": "openness score"
          }
        },
        "accessibility": {
          "semantics": {
            "metric": "semantic_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "issues"
          },
          "keyboard": {
            "metric": "keyboard_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "issues"
          },
          "controls": {
            "metric": "unlabelled_control_percent",
            "direction": "lower",
            "bands": [
              0,
              5,
              15,
              30
            ],
            "unit": "%"
          },
          "visual": {
            "metric": "visual_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "issues"
          },
          "resilience": {
            "metric": "raw_text_ratio_percent",
            "direction": "higher",
            "bands": [
              80,
              60,
              40,
              20
            ],
            "unit": "%"
          }
        },
        "responsibility": {
          "transparency": {
            "metric": "transparency_evidence_score",
            "direction": "higher",
            "bands": [
              90,
              75,
              55,
              35
            ],
            "unit": "evidence score"
          },
          "security": {
            "metric": "security_header_score",
            "direction": "higher",
            "bands": [
              100,
              83,
              67,
              50
            ],
            "unit": "% basic browser protections"
          },
          "consent_design": {
            "metric": "consent_issue_score",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              3
            ],
            "unit": "risk level"
          },
          "supplier_disclosure": {
            "metric": "undisclosed_provider_percent",
            "direction": "lower",
            "bands": [
              0,
              25,
              50,
              75
            ],
            "unit": "%"
          },
          "sustainability_governance": {
            "metric": "sustainability_evidence_score",
            "direction": "higher",
            "bands": [
              4,
              3,
              2,
              1
            ],
            "unit": "evidence signals"
          }
        }
      },
      "note": "EcoMark v4 expands the observable evidence sample to five connected pages, actively checks common policy and sitemap paths, validates six basic browser security protections and records lightweight PageSpeed-style diagnostics. It does not call Google PageSpeed Insights and does not claim Core Web Vitals field data.",
      "max_common_path_probes": 20,
      "pagespeed_style_checks": true,
      "security_header_checks": 6
    },
    "grades": [
      {
        "grade": "A",
        "min": 90,
        "max": 100
      },
      {
        "grade": "B",
        "min": 80,
        "max": 89
      },
      {
        "grade": "C",
        "min": 70,
        "max": 79
      },
      {
        "grade": "D",
        "min": 60,
        "max": 69
      },
      {
        "grade": "E",
        "min": 50,
        "max": 59
      },
      {
        "grade": "F",
        "min": 0,
        "max": 49
      }
    ],
    "categories": [
      {
        "key": "efficiency",
        "label": "Efficiency",
        "weight": 0.25,
        "short": "Resource use, page weight and avoidable computation.",
        "criteria": [
          {
            "key": "payload",
            "label": "Payload",
            "max_points": 20,
            "description": "Measured HTML and sampled asset payload is proportionate and optimised."
          },
          {
            "key": "javascript",
            "label": "JavaScript",
            "max_points": 20,
            "description": "Referenced JavaScript weight is kept proportionate."
          },
          {
            "key": "requests",
            "label": "Requests",
            "max_points": 20,
            "description": "Pages avoid excessive resource references and third-party connections."
          },
          {
            "key": "media",
            "label": "Media",
            "max_points": 20,
            "description": "Images and video avoid obvious loading and autoplay waste."
          },
          {
            "key": "caching",
            "label": "Caching and compression",
            "max_points": 20,
            "description": "Sampled static assets expose effective cache policy."
          }
        ]
      },
      {
        "key": "privacy",
        "label": "Privacy",
        "weight": 0.25,
        "short": "Tracking, cookies, profiling, analytics and consent.",
        "criteria": [
          {
            "key": "trackers",
            "label": "Behavioural tracking",
            "max_points": 20,
            "description": "Known advertising pixels and cross-site trackers are absent or minimised."
          },
          {
            "key": "analytics",
            "label": "Analytics minimisation",
            "max_points": 20,
            "description": "Analytics technology is absent or privacy-preserving and proportionate."
          },
          {
            "key": "cookies",
            "label": "Cookies and consent",
            "max_points": 20,
            "description": "Non-essential response cookies are avoided before interaction."
          },
          {
            "key": "third_party_data",
            "label": "Third-party disclosure",
            "max_points": 20,
            "description": "Resource loading does not unnecessarily disclose visits to third parties."
          },
          {
            "key": "invasive_techniques",
            "label": "Invasive techniques",
            "max_points": 20,
            "description": "Known session replay and similarly invasive tools are absent."
          }
        ]
      },
      {
        "key": "sovereignty",
        "label": "Sovereignty",
        "weight": 0.2,
        "short": "Ownership, geography, openness, portability and dependency.",
        "criteria": [
          {
            "key": "provider_jurisdiction",
            "label": "Provider jurisdiction",
            "max_points": 20,
            "description": "Observable visitor-facing dependencies minimise reliance on US-headquartered platform ecosystems."
          },
          {
            "key": "data_location",
            "label": "Third-party geography",
            "max_points": 20,
            "description": "Known non-EU third-party data exposure is minimised."
          },
          {
            "key": "portability",
            "label": "Portable delivery",
            "max_points": 20,
            "description": "Pages minimise proprietary embeds and platform-specific content dependencies."
          },
          {
            "key": "concentration",
            "label": "Supplier concentration",
            "max_points": 20,
            "description": "Third-party resource loading is not dominated by one provider ecosystem."
          },
          {
            "key": "openness",
            "label": "Open technology",
            "max_points": 20,
            "description": "Open standards, first-party delivery, open-source technology and public source code are preferred where practical."
          }
        ]
      },
      {
        "key": "accessibility",
        "label": "Accessibility",
        "weight": 0.15,
        "short": "Inclusive, semantic and resilient implementation.",
        "criteria": [
          {
            "key": "semantics",
            "label": "Semantics",
            "max_points": 20,
            "description": "HTML exposes basic language, heading and landmark structure."
          },
          {
            "key": "keyboard",
            "label": "Keyboard access",
            "max_points": 20,
            "description": "Markup avoids obvious keyboard-hostile interaction patterns."
          },
          {
            "key": "controls",
            "label": "Forms and controls",
            "max_points": 20,
            "description": "Form controls expose labels or accessible names."
          },
          {
            "key": "visual",
            "label": "Visual accessibility",
            "max_points": 20,
            "description": "Viewport and media markup avoid obvious visual accessibility barriers."
          },
          {
            "key": "resilience",
            "label": "Resilience",
            "max_points": 20,
            "description": "Meaningful text remains present without relying entirely on client rendering."
          }
        ]
      },
      {
        "key": "responsibility",
        "label": "Responsibility",
        "weight": 0.15,
        "short": "Transparency, security basics and responsible choices.",
        "criteria": [
          {
            "key": "transparency",
            "label": "Public accountability",
            "max_points": 20,
            "description": "Privacy, terms, accessibility, contact and applicable registration information are discoverable."
          },
          {
            "key": "security",
            "label": "Security basics",
            "max_points": 20,
            "description": "The main response exposes sensible browser security headers."
          },
          {
            "key": "consent_design",
            "label": "Consent design",
            "max_points": 20,
            "description": "Tracking and consent markup avoids obvious one-sided choice patterns."
          },
          {
            "key": "supplier_disclosure",
            "label": "Supplier disclosure",
            "max_points": 20,
            "description": "Detected material visitor-facing providers are reflected in discoverable privacy information."
          },
          {
            "key": "sustainability_governance",
            "label": "Sustainability evidence",
            "max_points": 20,
            "description": "Green hosting, carbon.txt and public sustainability information provide discoverable evidence of digital sustainability practice."
          }
        ]
      }
    ]
  },
  "algorithm_sha256": "fd7b59cbb2964a4f059df0645f095f1695a2d85bfcf776dc0d88da6f174781a4",
  "source_fingerprint": "ea18349b11082d1116b5c22aafe6213686a6fd1306d3bcd84981505e87171d9c",
  "external_sources": {
    "dns": "Cloudflare 1.1.1.1 DNS over HTTPS",
    "green_hosting": "Green Web Foundation Greencheck API",
    "performance": "EcoMark lightweight lab diagnostics; no Google PageSpeed API call"
  },
  "metrics": {
    "pages_checked": 5,
    "browser_rendered_homepage": false,
    "average_page_kb": 620,
    "average_javascript_kb": 0,
    "average_resource_references": 101,
    "media_issue_count": 148,
    "cacheable_asset_percent": 90,
    "tracker_count": 0,
    "analytics_risk": 0,
    "nonessential_cookie_count": 0,
    "third_party_percent": 90,
    "invasive_tracker_count": 0,
    "us_provider_count": 1,
    "known_non_eu_data_percent": 0,
    "proprietary_embed_count": 0,
    "top_provider_share_percent": 100,
    "first_party_asset_percent": 10,
    "semantic_issue_count": 0,
    "keyboard_issue_count": 0,
    "unlabelled_control_percent": 0,
    "visual_issue_count": 0,
    "raw_text_ratio_percent": 100,
    "missing_transparency_links": 2,
    "security_header_count": 5,
    "consent_issue_score": 0,
    "undisclosed_provider_percent": 0,
    "responsible_default_issue_count": 0,
    "dns_record_count": 16,
    "policy_pages_discovered": 5,
    "common_path_probe_count": 13,
    "sitemap_count": 1,
    "legal_identifier_count": 0,
    "public_source_repository": false,
    "open_source_technology_count": 1,
    "open_technology_score": 68,
    "transparency_evidence_score": 72,
    "sustainability_evidence_score": 0,
    "green_hosting_verified": false,
    "carbon_txt_found": false,
    "security_header_score": 83,
    "page_speed_checks_passed": 5,
    "page_speed_checks_total": 7,
    "homepage_response_ms": 41,
    "render_blocking_candidate_count": 2,
    "images_without_dimensions": 0
  },
  "analysis_quality": {
    "status": "good",
    "browser_result": "blocked-or-incomplete; static fallback used",
    "raw_homepage_status": 200,
    "raw_homepage_text_chars": 12519,
    "raw_homepage_resources": 130,
    "raw_homepage_response_ms": 41
  },
  "pages": [
    {
      "url": "https://proton.me/",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 444908
    },
    {
      "url": "https://proton.me/about",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 309651
    },
    {
      "url": "https://proton.me/about/impact",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 905922
    },
    {
      "url": "https://proton.me/about/team",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 435581
    },
    {
      "url": "https://proton.me/support/contact-product",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 338674
    }
  ],
  "documents": {
    "about": {
      "url": "https://proton.me/about",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "contact": {
      "url": "https://proton.me/support/contact-product",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "privacy": {
      "url": "https://proton.me/blog/privacy-ecosystem",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "terms": {
      "url": "https://proton.me/legal/terms",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "legal": {
      "url": "https://proton.me/legal/transparency",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    }
  },
  "document_probes": [
    {
      "kind": "cookies",
      "url": "https://proton.me/cookies",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "cookies",
      "url": "https://proton.me/cookie-policy",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "cookies",
      "url": "https://proton.me/cookiepolicy",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "cookies",
      "url": "https://proton.me/cookie_policy",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "cookies",
      "url": "https://proton.me/cookies-policy",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "cookies",
      "url": "https://proton.me/cookie-notice",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://proton.me/accessibility",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://proton.me/accessibility-statement",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://proton.me/accessibility_statement",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://proton.me/sustainability",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://proton.me/environment",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://proton.me/climate",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://proton.me/carbon",
      "reachable": false,
      "blocked_by_robots": false
    }
  ],
  "sitemaps": {
    "found": [
      "https://proton.me/sitemap.xml"
    ],
    "checked": [
      {
        "url": "https://proton.me/sitemap.xml",
        "reachable": true,
        "blocked_by_robots": false
      },
      {
        "url": "https://proton.me/sitemap_index.xml",
        "reachable": false,
        "blocked_by_robots": false
      },
      {
        "url": "https://proton.me/sitemap-index.xml",
        "reachable": false,
        "blocked_by_robots": false
      },
      {
        "url": "https://proton.me/sitemap.xml",
        "reachable": true,
        "blocked_by_robots": false
      }
    ]
  },
  "legal_identifiers": [],
  "dns": {
    "records": {
      "A": [
        "185.70.42.45"
      ],
      "AAAA": [],
      "CNAME": [],
      "MX": [
        "10 mail.protonmail.ch",
        "20 mailsec.protonmail.ch"
      ],
      "NS": [
        "ns1.proton.me",
        "ns2.proton.me",
        "ns3.proton.me"
      ],
      "TXT": [
        "yandex-verification: 95a7888a0f987e6a",
        "v=spf1 include:_spf.protonmail.ch ~all",
        "linkedin-site-verification=01e79150-bf68-4e0c-ad04-822dc1015b3b",
        "protonmail-verification=5262a92f988e64f1be1362138befdf1e19d6a4c1",
        "google-site-verification=2FGIDo-Gf-lWE6t_gWd9gpPTehHD85hbNiEujPVgysc",
        "google-site-verification=4UIZgETX8lGnv0WwpeJJbszo9daKOdXXYBKCA2XLf94",
        "google-site-verification=MUjtKY-4uQAjE92Z2-s1nm9m4mvdqY2z6HCvi_Bj4so",
        "google-site-verification=QviHfE1VQ57-tDmDLxM6BQH1mdgvdQ_0QsIvCht2IaU",
        "google-site-verification=_ayl1WqWIag2WkIbK4sNg_x3NCT5nYOl_DgtFPTYKeg",
        "zoom-domain-verification=ZOOM_verify_5990c1fbb09d4c6aba062cded6cbdf06"
      ],
      "WWW_CNAME": []
    },
    "record_count": 16,
    "carbon_txt_location": null
  },
  "security_headers": {
    "score": 83,
    "passed": 5,
    "total": 6,
    "checks": [
      {
        "key": "hsts",
        "label": "HSTS",
        "pass": true,
        "value": "max-age=31536000; includeSubDomains; preload"
      },
      {
        "key": "csp",
        "label": "Content Security Policy",
        "pass": true,
        "value": "default-src 'self'; media-src https://static.zdassets.com https://res.cloudinary.com https://pmecdn.protonweb.com; connect-src 'self' wss: https://protonmail.zendesk.com https://ekr.zdassets.com blob: https://account.proton.me https://reports.proton.me https://telemetry.proton.me https://*.algolia.net https://*.algolianet.com https://go.getproton.me https://noembed.com https://boards-api.greenhouse.io https://proton.me https://*.paypal.com https://*.paypalobjects.com https://growth.proton.me ; script-src 'self' blob: 'unsafe-eval' 'unsafe-inline'  https://static.zdassets.com https://pmecdn.protonweb.com https://www.youtube.com https://platform.twitter.com https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://pmecdn.protonweb.com https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://pmecdn.protonweb.com; img-src 'self' data: blob: https:; frame-src 'self' data: blob: https://www.youtube-nocookie.com https://platform.twitter.com https://*.paypal.com https://*.paypalobjects.com; object-src 'self' data: blob:; child-src 'self' data: blob: https://*.paypal.com https://*.paypalobjects.com; report-uri https://reports.proton.me/reports/csp; frame-ancestors 'self' https://*.proton.me;"
      },
      {
        "key": "nosniff",
        "label": "X-Content-Type-Options",
        "pass": true,
        "value": "nosniff"
      },
      {
        "key": "referrer",
        "label": "Referrer-Policy",
        "pass": true,
        "value": "strict-origin-when-cross-origin"
      },
      {
        "key": "permissions",
        "label": "Permissions-Policy",
        "pass": false,
        "value": null
      },
      {
        "key": "framing",
        "label": "Frame protection",
        "pass": true,
        "value": "CSP frame-ancestors"
      }
    ],
    "missing": [
      "Permissions-Policy"
    ]
  },
  "performance_diagnostics": {
    "kind": "lightweight-lab-proxy",
    "note": "These are EcoMark diagnostics inspired by common PageSpeed/Lighthouse checks. They are not a Google PageSpeed score and do not claim CrUX or Core Web Vitals field data.",
    "html_kb": 434,
    "response_ms": 41,
    "render_blocking_script_candidates": 0,
    "render_blocking_stylesheet_candidates": 2,
    "images_without_dimensions": 0,
    "images_without_lazy": 45,
    "passed": 5,
    "total": 7,
    "checks": [
      {
        "key": "response",
        "label": "Initial response under 800 ms from EcoMark",
        "pass": true,
        "value": "41 ms"
      },
      {
        "key": "payload",
        "label": "Measured page under 1 MB",
        "pass": true,
        "value": "620 KB/page"
      },
      {
        "key": "javascript",
        "label": "JavaScript under 250 KB/page",
        "pass": true,
        "value": "0 KB/page"
      },
      {
        "key": "requests",
        "label": "Fewer than 40 resource references/page",
        "pass": false,
        "value": "101 references/page"
      },
      {
        "key": "caching",
        "label": "At least 60% of sampled assets cacheable",
        "pass": true,
        "value": "90%"
      },
      {
        "key": "render_blocking",
        "label": "No obvious parser/render-blocking candidates",
        "pass": false,
        "value": "2 candidates"
      },
      {
        "key": "image_dimensions",
        "label": "Images include width and height",
        "pass": true,
        "value": "0 missing dimensions"
      }
    ]
  },
  "open_technologies": [
    "Astro"
  ],
  "source_repository": null,
  "green_web": {
    "checked": true,
    "green": false,
    "hosted_by": null,
    "supporting_documents": []
  },
  "carbon_txt": {
    "found": false,
    "method": null,
    "location": null
  },
  "providers": [],
  "tracker_urls": [],
  "assessment": {
    "id": "69e2061e-9988-4825-9b2d-500bae6d348c",
    "domain": "proton.me",
    "site_name": "Proton: Privacy by default",
    "website_url": "https://proton.me/",
    "ecomark_version": "4",
    "overall_score": 72,
    "grade": "C",
    "summary": "Automated EcoMark v4 approximation using up to 5 connected pages, DNS, active policy/sitemap discovery, browser security checks and lightweight performance diagnostics. Browser Run was blocked or incomplete, so the normal public HTML response was used instead. Analysis quality: good.",
    "assessed_on": "2026-08-30",
    "categories": [
      {
        "category": "efficiency",
        "score": 55,
        "criteria": {
          "payload": {
            "level": 3,
            "points": 15
          },
          "javascript": {
            "level": 4,
            "points": 20
          },
          "requests": {
            "level": 0,
            "points": 0
          },
          "media": {
            "level": 0,
            "points": 0
          },
          "caching": {
            "level": 4,
            "points": 20
          }
        },
        "priority": "high",
        "finding": "5 connected pages · ~620 KB measured/page · 0 KB JavaScript/page · 101 resource references/page · 90% sampled assets cacheable. PageSpeed-style checks: 5/7; 2 obvious blocking candidates; 0 images without width/height.",
        "evidence": "5 connected pages · ~620 KB measured/page · 0 KB JavaScript/page · 101 resource references/page · 90% sampled assets cacheable. PageSpeed-style checks: 5/7; 2 obvious blocking candidates; 0 images without width/height.",
        "why_it_matters": "Lighter pages consume less bandwidth and device work and remain usable on slower connections.",
        "action": "Reduce resource and third-party requests by consolidating assets and removing unnecessary integrations."
      },
      {
        "category": "privacy",
        "score": 80,
        "criteria": {
          "trackers": {
            "level": 4,
            "points": 20
          },
          "analytics": {
            "level": 4,
            "points": 20
          },
          "cookies": {
            "level": 4,
            "points": 20
          },
          "third_party_data": {
            "level": 0,
            "points": 0
          },
          "invasive_techniques": {
            "level": 4,
            "points": 20
          }
        },
        "priority": "low",
        "finding": "0 known trackers · 0 tracking-style response cookies · 90% third-party resource references.",
        "evidence": "0 known trackers · 0 tracking-style response cookies · 90% third-party resource references.",
        "why_it_matters": "Minimising tracking and third-party disclosure reduces profiling and unnecessary visitor data exposure.",
        "action": "Move commonly used assets and services first-party where practical."
      },
      {
        "category": "sovereignty",
        "score": 65,
        "criteria": {
          "provider_jurisdiction": {
            "level": 3,
            "points": 15
          },
          "data_location": {
            "level": 4,
            "points": 20
          },
          "portability": {
            "level": 4,
            "points": 20
          },
          "concentration": {
            "level": 0,
            "points": 0
          },
          "openness": {
            "level": 2,
            "points": 10
          }
        },
        "priority": "medium",
        "finding": "1 US-headquartered visitor-facing provider ecosystems · 10% first-party assets · open technology 68/100 · Astro. DNS: NS ns1.proton.me, ns2.proton.me · MX 10 mail.protonmail.ch, 20 mailsec.protonmail.ch.",
        "evidence": "1 US-headquartered visitor-facing provider ecosystems · 10% first-party assets · open technology 68/100 · Astro. DNS: NS ns1.proton.me, ns2.proton.me · MX 10 mail.protonmail.ch, 20 mailsec.protonmail.ch.",
        "why_it_matters": "A more portable and less concentrated stack gives organisations more control over technology and jurisdiction.",
        "action": "Avoid concentrating most third-party delivery in one provider ecosystem."
      },
      {
        "category": "accessibility",
        "score": 100,
        "criteria": {
          "semantics": {
            "level": 4,
            "points": 20
          },
          "keyboard": {
            "level": 4,
            "points": 20
          },
          "controls": {
            "level": 4,
            "points": 20
          },
          "visual": {
            "level": 4,
            "points": 20
          },
          "resilience": {
            "level": 4,
            "points": 20
          }
        },
        "priority": "low",
        "finding": "0 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.",
        "evidence": "0 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.",
        "why_it_matters": "Accessible, resilient markup works for more people, assistive technology and older or constrained devices.",
        "action": "No material issue was detected in this category. Maintain the current practice and re-run EcoMark after material website changes."
      },
      {
        "category": "responsibility",
        "score": 65,
        "criteria": {
          "transparency": {
            "level": 2,
            "points": 10
          },
          "security": {
            "level": 3,
            "points": 15
          },
          "consent_design": {
            "level": 4,
            "points": 20
          },
          "supplier_disclosure": {
            "level": 4,
            "points": 20
          },
          "sustainability_governance": {
            "level": 0,
            "points": 0
          }
        },
        "priority": "medium",
        "finding": "Privacy ✓ · Cookies n/a · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: none detected. no verified green-hosting evidence found. carbon.txt ✗ · sitemap ✓ · security 5/6. Missing: Permissions-Policy.",
        "evidence": "Privacy ✓ · Cookies n/a · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: none detected. no verified green-hosting evidence found. carbon.txt ✗ · sitemap ✓ · security 5/6. Missing: Permissions-Policy.",
        "why_it_matters": "Transparent, secure defaults make digital impact understandable and give visitors meaningful choices.",
        "action": "Publish sustainability evidence, consider carbon.txt, and use independently verified green hosting where practical."
      }
    ]
  }
}
