Two-factor authentication required.
Every user signs in with a second step. This applies to administrators too.
Security
Verifiable, down the supply chain.
For every component you see which party, which country and which certificate. Data stays in the Netherlands or the EU, with European parties without an American parent company.
Standards
Where certification stands.
The platform and the way we work are set up in line with both standards. Certification follows in 2027.
ISO 27001 and NEN 7510In preparation
Set up in line with ISO 27001 and NEN 7510, certification in 2027.
Hosting and sovereignty
Where your data is.
Every client has its own servers and its own database. Hosting is at Hetzner in Germany, on request on servers in the Netherlands. So the data stays in the Netherlands or the EU, with European parties without an American parent company.
| Component | Party | Country | Certificate |
|---|---|---|---|
| Hosting environment | Hetzner | Germany (on request the Netherlands) | ISO 27001 |
| Backup | Own storage, own hardware | Netherlands | Our ISMS |
| AI servers | Own hardware | Netherlands, Leiden | Our ISMS |
| Own mail server | Germany | ISO 27001 (Hetzner) | |
| Monitoring | Own monitoring | Germany | ISO 27001 (Hetzner) |
| Exit | Export of all data in an open format, at any time. A handover package at termination. | ||
Measures
Security is part of the build.
These measures apply in every environment. You do not have to switch them on.
Roles and rights down to field level.
Rights per role, down to the level of a single field. Every user sees only what belongs to their task.
A record of who viewed what.
The system records who opened or changed which case file and which document, and when.
Stored encrypted.
Documents are stored encrypted and can only be opened through the system, after a check of the permissions.
Independently tested every year.
Every year an independent party tests the platform. We resolve the findings and have them tested again.
In line with WCAG.
Portals and forms follow WCAG 2.2 at level AA, so everyone can use them.
Logging and service
Agreements you can verify.
Every view and change is recorded with user, time and component. Availability and incident notification are set out in the service level.
- views and changes, per case file
- [to follow] per month
- within [to follow]
- daily, with a yearly restore test
Exit and export
You are not locked in.
Your data remains yours. Leaving is arranged in advance.
- Full export of all data and documents, at any time
- A handover package at termination
- Clear exit agreements, set out in advance
See how it works for your process?
Request an introduction. You speak to the people who build the system.