Credits

Almost everything here was made by other people and given away. This page names it, because a consultancy that will not say what it runs is asking for a trust it has not offered.

It is also the shortest honest answer to “what do you actually work with”. The list below is not a capability brochure — it is this site’s own bill of materials, and you can check every line of it from your own browser.

This copy of the site is from October 26, 2026, 19:43 CET — the moment the newest page in this copy last changed. Every focused subdomain carries the same line about its own copy, which is made later than this one and says so.

What reaches your browser

Five things, and nothing else: HTML, one stylesheet, three webfonts, images, and one small script of our own.

• HTML, written out in full before you asked for it. Every page is a file on disk, not a template assembled per request.
• One CSS bundle, concatenated and fingerprinted at build time and served with a Subresource Integrity hash, so your browser can verify it arrived unmodified. Inside it rides neat-annotations by Max Syabro (MIT) — the hand-drawn arrows and margin notes, drawn in CSS alone.
• The Ubuntu typeface, by Dalton Maag for Canonical, under the Ubuntu Font Licence. Served from our own machine — a webfont from someone else’s CDN is a third party watching you read.
• Ubuntu Mono, the same family’s fixed-width cut, under the same licence and served the same way. It sets the code on these pages, and loads only on the pages that carry some.
• The Shantell Sans typeface, based on the artist Shantell Martin’s felt-marker handwriting, by Arrow Type / Stephen Nixon, under the SIL Open Font License. It writes the margin notes, is served the same way, and loads only on the pages that carry one.
• WebP and PNG images, sized at build time. The walls these pages are built on are photographs. Two are from Unsplash: Tim Mossholder shot the dark plaster, Joe Woods the white brick. Three more are John Snow’s, shot on a Galaxy S22 Ultra and given to this site: the pale plaster, the painted brick and the tiled wall. The light theme wears one of its four walls, drawn while the page is built, so the site is dressed afresh each time it is published. The licence does not ask for a credit; a page that names a typeface’s designer should not need asking. The mark, the cog, the mascot in every pose you will meet it in, the portrait and the two overlapped photographs of our own Copenhagen office on the about page are ours, shot or drawn here and stripped of their metadata before they were committed. The photographs in the bands across these pages are from Pixabay, under the Pixabay Content License, and each names its photographer to a screen reader.
• One borrowed icon set, and one drawing from a second. The pictures of what a piece of work was made of — one beside every achievement in every list, a row of them under every review, one behind each figure and each service on the front page — and every other icon this site draws: the marks on both menus and behind each page, the contact line, the networks, the language switch, the arrows and the chevrons. All of them but one come from Font Awesome Free 7.3.1 by Fonticons, under CC BY 4.0: 281 drawings in all, kept in this repository and served from this host like everything else. 51 are not drawings of an idea but the technologies’ own marks — PostgreSQL, Linux, Docker, Go, Swift, Rust and the rest — naming what a job was actually built on. A mark is used where the record supports it and a plain picture where it would not: the database work also runs on MS SQL and BigQuery, so it keeps a drawing of a database rather than any one vendor’s logo, and work built away from something never wears that thing’s mark. A trademark stands for its owner, so an exact borrowed mark is better than one redrawn to match our set, and where there is no mark to borrow we use a plain picture instead of inventing one. The rows of logos that say which products we work with use the same marks, and each stays its owner’s trademark: naming a product claims no endorsement from its owner. The one exception is the processor chip marked AI that stands beside the picture of each of our AI services, wherever that picture appears, and beside the menu entry for AI agents. It is cpu-ai, the only drawing taken from Lucide 1.61.0 by Lucide Icons and Contributors, under the ISC License, and it is kept and served the same way. The identity itself is ours throughout: the brand mark, the cog, the mascot, the portrait and the office photographs. The credit sits on this page rather than in the files, because the build minifies its HTML and strips the comment each icon ships its attribution in.

One script runs on this site: ours, about a kilobyte, on the pages that hold a list — the work, the subjects, the offerings, the cases and the sitemap — where it filters that list as you type. It talks to nobody and remembers nothing. No cookies are set. Nothing is requested from another company’s server — no analytics, no fonts, no embedded video, no consent banner, because there is nothing to consent to. Open your browser’s network panel and count the hosts: there is one.

How the pages are made

• Hugo — the static site generator, written in Go. Templates, taxonomies, every language and the feeds are its work.
• Markdown and Go templates for the hand-written pages and the layouts.
• SQLite — the portfolio is not authored here. It lives in a multilingual CV database and is exported into this site by a Python script, so a fact is written once and appears wherever it belongs.
• Python for that exporter, and for generating the icon set with ImageMagick from a single drawing of the mark.

How it is proved

There is no hosted build service; the quality gate runs on the machine the site is written on, and every diagnostic is an error rather than a warning.

• vnu validates the HTML, Stylelint the CSS.
• axe-core audits 39 representative pages — one per template, in every language — against WCAG 2.2 A and AA, in both colour schemes, and it is in the gate, not beside it. The site builds 2,302 pages; a machine finds about a third of what WCAG asks, and that is why the record below is per criterion rather than a pass mark.
• Puppeteer drives headless Chromium for the checks a validator cannot make: measured contrast, focus order, target size, reading measure, viewport overflow, print pagination, and a pixel-for-pixel visual regression via pixelmatch. The gate runs all but two of them before every push; a person runs the other two, viewport overflow and the visual regression, on demand. Puppeteer also takes the picture other sites show when a link here is shared, so that card is this page’s own stylesheet and typeface rather than a drawing of them.
• Lighthouse holds the performance budgets; lychee checks that every link still resolves.
• Prettier, markdownlint, ESLint, Ruff, basedpyright, yamllint, ShellCheck and codespell keep the source honest; gitleaks makes sure no secret is ever committed.
• Task runs all of it under one name per job, and pre-commit runs the file-level half again on every commit, so the gate is not something anyone has to remember.

Where it runs

One small machine does all of it: a single-core DigitalOcean server with 512 MB of memory and a 10 GB disk, standing in Toronto, Canada, answering at 165.227.39.206. That address is what DNS already hands to anyone who asks, so printing it here saves you the lookup rather than telling you anything new. What the machine records while it answers is on the privacy page.

• Debian is the operating system.
• Caddy answers every web request and renews the HTTPS certificate itself, from Let’s Encrypt.
• Agate, Gophernicus and Tor answer the other three: this site is also a Gemini capsule at gemini://engineer.company, a Gopher hole at gopher://engineer.company and an onion service at http://engineer2ezpeji52ipphljcflzyhetvy5r6tnqubtq45nzlxxv6rsqd.onion/. All four read the same folder of files, so one deploy updates all four and none of them can drift from the others. The onion is the only front door we could add without opening a port: tor dials out to introduction points, so the machine’s open ports stay exactly as they were. The web site sends an Onion-Location header too, so Tor Browser offers it without being asked. It begins engineer because we spent the CPU hours to make it readable — a convenience, not a proof. The same prefix is available to anyone willing to spend the same hours, so compare the whole address rather than the start of it.
• Ansible describes that server as code, so it can be rebuilt rather than remembered.
• Soft Serve is the git server behind the Git Hub at git.engineer.company. This site’s own source lives there.
• restic takes the backups off the box.
• Cloudflare answers DNS — and only DNS. The site is deliberately not proxied: openness is worth more to us than the protection, and a proxy would put one more company between you and us.
• Mail is Apple iCloud, which is why the address on the contact page reaches a mailbox and not a marketing platform.

Where else it answers

Everything above describes one site, and it lives at engineer.company. The same work is also served at a focused address for each trade: whoever arrives at one of them is shown that trade first and the company’s own pages unchanged, and every one of those pages names the copy at engineer.company as the original.

• data.engineer.company — databases and the pipelines that fill them.
• platform.engineer.company — cloud infrastructure and the machinery that deploys it.
• software.engineer.company — software built to be maintained rather than only delivered.
• advisory.engineer.company — consulting, architecture and technical leadership.
• brand.engineer.company — brand and marketing work.
• support.engineer.company — the machines, networks and helpdesk an office runs on.
• ditte.engineer.company — the founder’s own pages, which also answer at daryna.engineer.company.

And git.engineer.company is the front door of the git server named above: the repositories are private and reached over SSH, so that page is all the web is shown.

The site is also complete in Ukrainian, Norwegian and Swedish — every page, indexed and named in the sitemaps beside its Danish and English twins. The strip in the top bar does not offer them, so these links are the way in.

Standards it follows

• WCAG 2.2 level AA, guarded rather than claimed — with one criterion named as an exception rather than glossed. The labels that appear when you hover or focus a mark cannot be dismissed with a key, because dismissing needs a script and this site runs one script only. 1.4.13 is met but for that half, and it is written here rather than left for somebody to discover. The accessibility statement sets out what is checked and where the checks stop.
• schema.org structured data, marking only what is true and visible on the page.
• Web App Manifest, so the site can be installed as an app.
• RSS, Atom and JSON Feed, all three carrying the full text. Two XML feeds rather than one because some readers take only one of the two and neither is reliably the one.
• RFC 9309 robots.txt, which allows everything, to search crawlers and AI systems alike — the writing here exists to be read, and it names the sitemap both of them follow. There is a readable index of the same pages, for anyone who would rather browse it than parse it.
• RFC 9116 security.txt, plus humans.txt, llms.txt, agents.txt and ai.txt for the machines that come asking — and ads.txt, which authorises nobody, because there are no advertisements here to sell.
• Gemini, RFC 1436 Gopher and Tor onion services: the same pages, served over all three at gemini://engineer.company, gopher://engineer.company and http://engineer2ezpeji52ipphljcflzyhetvy5r6tnqubtq45nzlxxv6rsqd.onion/, out of the same folder of files this page comes from — one deploy updates all four. Gemini and Gopher each want their own client rather than a browser; the onion wants a Tor client, and Tor Browser is the ordinary one. Gopher has no encryption layer at all, so it carries which page you read in the clear; Gemini encrypts that, but the network you read from still sees which address you asked for. Over the onion it sees neither: of the four, that is true only there. The address itself is the service’s public key, so the circuit is authenticated and encrypted before a word of HTTP is spoken — the http:// is correct rather than careless, and a certificate would only prove a name the address already proves by arithmetic.

Check it yourself

Everything above is a claim, and the earlier section on how it is proved names the tools we run against our own machine — which is us marking our own homework. These are the same questions asked by people who have never heard of us. Every link runs a live test against this page, or the address bar of the one you are on; none of them takes our word for anything, and none of them is ours.

• The W3C Markup Validator parses this page’s HTML against the living standard. It is the same engine as the vnu above, run by the W3C rather than by us.
• The W3C CSS Validator reads the stylesheet this page is wearing. Expect it to report errors, and read them before believing them: as of August 2026 it validates against a profile that stops short of system-ui, @property, clamp() in a font-size and scroll-driven animations — all four shipped in browsers, and all four used here. Against /terms/ it reported 176 complaints, and 175 were of exactly that kind. The one that was not had caught a real defect: a resting rotate: 0deg loses its unit to the minifier, rotate: 0 is not an angle, and the browser drops the whole line — so an animation shipped without the rotation it was written with. Stylelint cannot see that, because it reads the stylesheet we write and the minifier rewrites it on the way to you. Stylelint remains the authority we hold the source to, and a check of our own now reads what was actually served.
• The W3C Feed Validator checks the Atom feed, and the same service checks the RSS one. It warns that most entries share a modification date, and that warning is correct: the dates come from git history, and most of these pages genuinely were written in the same few commits. We would rather show a warning than invent a date.
• The JSON Feed Validator checks the third feed, which the W3C service does not cover — it predates the format.
• PWABuilder reads the manifest and the rest of what makes the site installable, from Microsoft’s machines rather than ours.
• The W3C Internationalization Checker reads the language and encoding declarations that make every language version of this site legible to the right reader.
• The Schema Markup Validator reads the structured data, and Google’s Rich Results Test says what a search engine does with it.
• PageSpeed Insights runs Lighthouse from Google’s machines rather than ours — performance, accessibility, best practices and SEO, with real-world data where enough people have visited.
• The Mozilla HTTP Observatory grades the security headers, and Qualys SSL Labs grades the HTTPS configuration behind them.
• Security Headers is a second opinion on the first of those, from someone else entirely.

What none of them can check is the accessibility claim, and we would rather say so than let a green badge imply otherwise. No automated tool finds more than about a third of WCAG failures — the rest are judgements about whether a heading describes its section or an alt text says the useful thing, and a machine cannot make them. The audits above are the floor, not the proof. If you use a screen reader here and something reads wrongly, tell us — that is the report we cannot generate.

Thank you

Every project above is maintained by people who did not have to share any of it. If you build on this stack too, that is where your money and your bug reports are worth most.

And if this stack reads like your kind of engineering, put ours to work.