diff --git a/server/services/previewDeploy.js b/server/services/previewDeploy.js
index 4e1eb52..a4d910c 100644
--- a/server/services/previewDeploy.js
+++ b/server/services/previewDeploy.js
@@ -713,14 +713,17 @@ async function buildAnalytics(project) {
     } catch (err) {
       if (err.status !== 404) throw err
     }
-    const company = String(customer?.companyName || customer?.name || '').trim()
-    const email = String(customer?.email || '').trim()
-    if (!company || !email) {
-      console.warn(`[previewDeploy] Analyse fuer Projekt ${project.$id} uebersprungen: Firma oder E-Mail fehlt`)
+    const clean = (v) => String(v ?? '').replace(/[\x00-\x1f\x7f]/g, ' ').replace(/\s+/g, ' ').trim()
+    const company = clean(customer?.companyName || customer?.name).slice(0, 200).trim()
+    const email = clean(customer?.email)
+    if (!company || !email || email.length > 200 || !email.includes('@')) {
+      console.warn(`[previewDeploy] Analyse fuer Projekt ${project.$id} uebersprungen: Firma oder E-Mail fehlt/ungueltig`)
       return null
     }
-    const address = [String(customer.street || '').trim(), `${customer.postalCode || ''} ${customer.city || ''}`.trim()].filter(Boolean).join(', ')
-    return { siteKey: feature.siteKey, color: feature.accentColor || '#111111', privacy: { company, address, email } }
+    const address = [clean(customer.street), clean(`${customer.postalCode || ''} ${customer.city || ''}`)].filter(Boolean).join(', ').slice(0, 300).trim()
+    const stored = String(feature.accentColor || '').toLowerCase()
+    const color = /^#[0-9a-f]{6}$/.test(stored) ? stored : '#111111'
+    return { siteKey: feature.siteKey, color, privacy: { company, address, email } }
   } catch (err) {
     console.warn(`[previewDeploy] Analyse-Abfrage fuer Projekt ${project?.$id} fehlgeschlagen: ${err.message}`)
     return null
diff --git a/test/previewRunner.test.js b/test/previewRunner.test.js
index 1edb71a..a1adb3a 100644
--- a/test/previewRunner.test.js
+++ b/test/previewRunner.test.js
@@ -441,3 +441,19 @@ test('Analyse: Dev-PUT nach erfolgreichem Build (Modus dev) enthält kein analyt
   assert.ok(puts.length >= 1)
   for (const c of puts) assert.equal('analytics' in c.body, false)
 })
+
+test('Analyse: überlange Angaben, Steuerzeichen, schlechte Farbe ⇒ Grenzen eingehalten, Auftrag geht raus', async (t) => {
+  t.mock.method(console, 'warn', () => {})
+  const p = await analyseProject({
+    feature: { accentColor: 'rot' },
+    customer: { companyName: 'F\u0007irma ' + 'x'.repeat(250), street: 's'.repeat(400) },
+  })
+  const a = (await submitFor(p)).analytics
+  assert.equal(a.color, '#111111')
+  assert.ok(a.privacy.company.length <= 200 && !/[\x00-\x1f]/.test(a.privacy.company))
+  assert.ok(a.privacy.address.length <= 300)
+  const q = await analyseProject({ customer: { email: 'a'.repeat(250) + '@x.de' } })
+  assert.equal((await submitFor(q)).analytics, null)
+  const r = await analyseProject({ customer: { email: 'keine-mail' } })
+  assert.equal((await submitFor(r)).analytics, null)
+})