Organization
- Name
- Uwitz
- Type
- Independent privacy and security organisation
- Website
https://uwitz.org- Mission
- Protect the privacy and security of the public through open-source tools, independent research, and education
- Funding
- Donation-based, community-funded. No venture capital, no ads, no tracking.
- Legal status
- Unincorporated. Preparing to register in Estonia.
- Contact
admin@uwitz.org- Logo
https://uwitz.org/assets/shield_logo.png(PNG),https://uwitz.org/assets/uwitz_shield.svg(SVG)
Divisions
- Uwitz Juniors
- Privacy education for students, young developers, and community groups. Site:
https://education.uwitz.org. Teaches operational security, digital literacy, and runs opsec workshops. - Uwitz Corporate
- Commercial security arm. Provides paid audits, penetration testing, threat modelling, and security training. Revenue funds the free/open-source work. Site:
https://uwitz.co
Site structure
/— Landing page. Mission, divisions, careers, donation CTA./about— About the organisation, team, and divisions./juniors— Uwitz Juniors division page./corporate— Uwitz Corporate division page./apply— Job and internship applications. Positions listed dynamically./donate— Donation page with Stripe integration./education— Education resources./privacy— Privacy policy./terms— Terms of use./agent— This page. Machine-readable site information./login— Staff SSO login (Irys + Entra ID via OIDC). Restricted./admin— Staff admin console. Restricted.
Public API endpoints
All API responses return JSON. API routes bypass CDN caching.
Positions
GET /api/positions
Returns the list of open positions (internships and full-time roles).
[
{
"id": 1,
"title": "Security Research Intern",
"type": "internship",
"description": "Assist with vulnerability research...",
"location": "Remote",
"duration": "3–6 months"
}
]
Submit application
POST /api/apply
Content-Type: application/json
{
"name": "string (required)",
"email": "string (required)",
"position": "string (required)",
"portfolio": "string (optional)",
"coverLetter": "string (optional)"
}
Submits a job application. Sends a notification to the team via NTFY and stores the application for admin review. Returns {"success": true, "id": number}.
Payments (Stripe)
POST /api/create-payment-intent
Content-Type: application/json
{
"amount": number (cents, min 100),
"paymentMethodId": "string",
"frequency": "once" | "monthly"
}
Creates a Stripe payment intent for donations. Monthly creates a subscription.
Technology
- Runtime
- Node.js 22
- Framework
- Express.js (HTTPS via self-signed cert)
- Frontend
- Vanilla HTML/CSS/JS, no framework. Custom design system (
css/ds.css). - Fonts
- Geist (sans) + Geist Mono (monospace), self-hosted
- Payments
- Stripe (card processing, subscriptions)
- CDN
- Fastly (caching, edge)
- Reverse proxy
- Nginx (TLS termination, security headers)
- Auth
- Irys SSO (OAuth 2.0) + Entra ID (OIDC)
- Notifications
- NTFY (self-hosted at
https://zap.uwitz.org) - Notifications channel
jobs— receives job application notifications
Design principles
- Privacy first — No analytics, no tracking, no third-party cookies. Zero telemetry.
- Open source — All tools ship with auditable source code.
- Self-hosted — Fonts, infrastructure, and services are self-hosted to avoid third-party tracking.
- Minimal dependencies — Few external services. Stripe (payments), Irys (auth), NTFY (notifications).
- Data minimisation — Collect only what's necessary. Applications stored server-side, not shared.
Structured data
This page is designed for machine consumption. Key identifiers:
{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Uwitz",
"url": "https://uwitz.org",
"logo": "https://uwitz.org/assets/shield_logo.png",
"description": "Independent privacy and security organisation — open-source tools, public research, and education.",
"email": "admin@uwitz.org",
"sameAs": [
"https://juniors.uwitz.org",
"https://uwitz.co"
]
}
Last updated: August 2026. This page is maintained by the Uwitz team and updated as the site evolves.