diff --git a/src/locales/de/LC_MESSAGES/reference/security/data-protection.po b/src/locales/de/LC_MESSAGES/reference/security/data-protection.po
index b2d73fc1..d7f57460 100644
--- a/src/locales/de/LC_MESSAGES/reference/security/data-protection.po
+++ b/src/locales/de/LC_MESSAGES/reference/security/data-protection.po
@@ -48,8 +48,8 @@ msgid ""
 "Germany's [federal data protection law "
 "(BDSG)](http://de.wikipedia.org/wiki/Bundesdatenschutzgesetz), and"
 msgstr ""
-"Das [Bundesdatenschutzgesetz (BDSG)]"
-"(http://de.wikipedia.org/wiki/Bundesdatenschutzgesetz), und"
+"Das [Bundesdatenschutzgesetz "
+"(BDSG)](http://de.wikipedia.org/wiki/Bundesdatenschutzgesetz), und"
 
 #: ../../../src/reference/security/data-protection.md:23
 msgid ""
@@ -196,12 +196,12 @@ msgid ""
 "The physical assets (servers, switches, hard drives, ...) are located in "
 "EU data centers operated by third parties. The ownership of the physical "
 "equipment is with the Flying Circus, or, in special cases by our "
-"customers [^customer-owned]."
+"customers. [^customer-owned]:"
 msgstr ""
 "Die physischen Anlagen (Server, Switches, Festplatten, ...) befinden sich"
 " in EU-Rechenzentren, die von Dritten betrieben werden. Das Eigentum an "
 "den physischen Anlagen liegt beim Flying Circus, oder, in besonderen "
-"Fällen, bei unseren Kunden [^customer-owned]."
+"Fällen, bei unseren Kunden. [^customer-owned]"
 
 #: ../../../src/reference/security/data-protection.md:86
 msgid "For each data center used by us we require the following measures:"
@@ -394,14 +394,14 @@ msgstr ""
 msgid ""
 "SSH logins must be performed using SSH keys. Password authentication is "
 "not allowed and prevented by the system configuration. Successful SSH "
-"logins to machines are logged, unsuccessful SSH login attempts are not "
-"[^log-unsuccessful-attempts]."
+"logins to machines are logged, unsuccessful SSH login attempts are not. "
+"[^log-unsuccessful-attempts]:"
 msgstr ""
 "SSH-Logins müssen mit SSH-Schlüsseln durchgeführt werden. "
 "Passwortauthentifizierung ist nicht erlaubt und wird durch die "
 "Systemkonfiguration verhindert. Erfolgreiche SSH-Anmeldungen an Maschinen"
-" werden protokolliert, erfolglose SSH-Anmeldeversuche nicht [^log-"
-"unsuccessful-attempts]."
+" werden protokolliert, erfolglose SSH-Anmeldeversuche nicht. [^log-"
+"unsuccessful-attempts]"
 
 #: ../../../src/reference/security/data-protection.md:146
 msgid "Access control"
@@ -503,7 +503,7 @@ msgstr "Notfall-Root-Logins (siehe oben in {ref}`entry-control`)."
 #: ../../../src/reference/security/data-protection.md:185
 msgid ""
 "Authorized and unauthorized access to privileged operations is logged and"
-" analysed on a central loghost within the same site. [^trace-tty]"
+" analysed on a central loghost within the same site. [^trace-tty]:"
 msgstr ""
 "Autorisierte und unautorisierte Zugriffe auf privilegierte Operationen "
 "werden auf einem zentralen Loghost innerhalb desselben Standorts "
diff --git a/src/reference/security/data-protection.md b/src/reference/security/data-protection.md
index 372119d1..045db518 100644
--- a/src/reference/security/data-protection.md
+++ b/src/reference/security/data-protection.md
@@ -80,8 +80,8 @@ physically access the data processing equipment.**
 
 The physical assets (servers, switches, hard drives, ...) are located in EU
 data centers operated by third parties. The ownership of the physical equipment
-is with the Flying Circus, or, in special cases by our customers
-[^customer-owned].
+is with the Flying Circus, or, in special cases by our customers.
+[^customer-owned]
 
 For each data center used by us we require the following measures:
 
@@ -139,7 +139,7 @@ authentication is not working correctly. Such uses must be documented.
 
 All privileged actions need to be securely logged. For machines based on our current (NixOS) platform, this is achieved via a local logging journal, which cannot be tampered with by normal users. Additionally systems logs are shipped to a central log server within the same site where the logs are analysed and monitored.
 
-SSH logins must be performed using SSH keys. Password authentication is not allowed and prevented by the system configuration. Successful SSH logins to machines are logged, unsuccessful SSH login attempts are not [^log-unsuccessful-attempts].
+SSH logins must be performed using SSH keys. Password authentication is not allowed and prevented by the system configuration. Successful SSH logins to machines are logged, unsuccessful SSH login attempts are not. [^log-unsuccessful-attempts]
 
 (access-control)=