diff --git a/Makefile b/Makefile
index 0f6d87b..98424f8 100644
--- a/Makefile
+++ b/Makefile
@@ -31,6 +31,8 @@ up:
 
 KEYBASE_FILE ?= keybase.txt
 ROBOTS_FILE ?= robots.txt.staging
+ANALYTICSTXT_FILE ?= analytics.txt
+SECURITYTXT_FILE ?= security.txt
 SITEURL ?= http://localhost:8000
 
 .PHONY: build
@@ -42,4 +44,7 @@ build:
 	@docker cp assets:/code/homepage/output/. ./output/
 	@cp build/${ROBOTS_FILE} ./output/robots.txt
 	@cp build/${KEYBASE_FILE} ./output/keybase.txt
+	@mkdir -p ./output/.well-known
+	@cp build/${ANALYTICSTXT_FILE} ./output/.well-known/analytics.txt
+	@cp build/${SECURITYTXT_FILE} ./output/.well-known/security.txt
 	@docker rm assets
diff --git a/build/analytics.txt b/build/analytics.txt
new file mode 100644
index 0000000..95c2cbb
--- /dev/null
+++ b/build/analytics.txt
@@ -0,0 +1,19 @@
+# analytics.txt file for www.offen.dev
+Author: Frederik Ring <hioffen@posteo.de>
+
+Collects: url, referrer, device-type
+Stores: first-party-cookies, local-storage
+# Usage data is encrypted end-to-end
+Uses: javascript
+# Users can also delete their usage data only without opting out
+Allows: opt-in, opt-out
+# Data is retained for 6 months
+Retains: P6M
+
+# Optional fields
+Honors: none
+Tracks: sessions, users
+Varies: none
+Shares: per-user
+Implements: gdpr
+Deploys: offen
diff --git a/build/security.txt b/build/security.txt
new file mode 100644
index 0000000..b8c486b
--- /dev/null
+++ b/build/security.txt
@@ -0,0 +1,3 @@
+Contact: mailto:hioffen@posteo.de
+Expires: Sat, 31 Dec 2022 23:59 +0200
+Policy: https://github.com/offen/offen/blob/development/SECURITY.md