I built a status page with zero third-party requests. Here's what it took.

Most status pages I've audited load between 8 and 15 third-party resources: Google Fonts, analytics beacons, session recorders, icon CDNs, sometimes embedded chat widgets. For a page whose entire job is to communicate "something is broken, stay calm," that's a lot of attack surface — and a lot of DPA paperwork if you sell into the EU. I'm building FoundersDeck , a GDPR-native monitoring toolkit. When I designed the status page, I set one hard constraint: The page makes requests to exactly one do