About this demonstration instance
Everything about this instance in one place: where the data comes from, what it can accept, what a restart does, the licence the source is published under, and how things stand on accessibility.
The full notice
Demo-Instanz mit ausschliesslich SYNTHETISCHEN Daten. Kein Vorgang auf diesen Seiten gehoert zu einer echten Person: jede Versicherungsnummer, jeder Name und jede Anschrift ist erzeugt. Der Eingang ist nur mit Token erreichbar - senden Sie hier keine echten Daten -, und der gesamte Datenbestand wird bei jedem Neustart geloescht und neu aufgebaut. This is a public demonstration instance: all data is synthetic, ingest is token-gated, and the state is reset on every restart.
This is the wording the deployment itself carries. It is reproduced verbatim and is the same text in both language settings.
No real data - ever
Do not send anything here that belongs to a person. No name, no date of birth, no insurance number, no address. The demo's storage backend is unencrypted JSONL, and it is defensible precisely because it holds nothing but invented values. The fictional applicants on the intake page are additionally checked to make sure none of their values occurs in the gold corpus or in the redaction canary set.
The entire state comes from the frozen gold corpus corpus/gold/v4. A gold set is never edited: a label that turns out to be wrong is superseded by a new versioned set rather than corrected in place.
The ingest endpoint
Ingest is reachable only with this deployment's token (header X-Ingest-Token); without it POST /ingest answers 403. Do not send real data even with the token: this demo's storage backend is unencrypted.
The check is middleware, not a route dependency, and that is the difference between "refused" and "never read": a framework decodes the request body before it resolves a route's dependencies. A refusal at that point would come too late - this process would already have read a stranger's submission.
Reset by restart
The state is deleted on every start and rebuilt from the gold corpus; two seedings of the same corpus with the same base clock produce the same state. That is exactly why the caseworker actions are left open: whatever you confirm, re-route or escalate is gone at the next start. The intake page's scratch store lives in memory only, holds an entry for a short time and dies with the process.
Picking a unit is a demo convenience with no sign-in: the unit sits in the address bar. A real authorisation model with an identity provider is a pilot prerequisite (C-5) and does not exist here.
Licence and source
The source is published under the EUPL-1.2. The repository carries the architecture decision records, the technical specification, the known errors and the accessibility self-assessment.
Source code and the full technical specification: To the repository. Licence: EUPL-1.2.
Accessibility
A self-assessment against EN 301 549 V3.2.1 / WCAG 2.1 AA lives in docs/accessibility-selfcheck.md. It is a self-assessment and not a BITV 2.0 test: it was written by the implementing engineer, no person with a disability has used these pages, and no assistive technology has been run against them. An accessibility statement under par. 12b BGG may NOT be derived from it.
Everything a machine can check is checked on every commit: a skip link as the first focusable element of every page, a label for every control, a caption for every table, no meaning carried by colour alone, a focus ring that is restyled and never removed, and the reflow rules for a 320 pixel viewport. What a static test cannot decide is listed in the document as open rather than as passed.