Trust Centre

Yes. Our processes are set up in line with the ISO 27001 standard for information security and we are audited annually by DigiTrust. You can download the certificate above, and the Statement of Applicability is available on request.

All data and resources are hosted exclusively in Amsterdam (NL) and therefore inside the European Union. No production data goes to an environment outside the EU.

Yes. Separation per organisation is enforced in the platform itself, not only in the screens, and every customer integration has its own credentials that are never shared. If you want to go further, we can provide a separately provisioned environment for you.

Only the people who need it for their work, with personal accounts under least privilege and always with two-factor authentication. We review who has which access periodically and remove what is no longer needed. Everyone is bound by a confidentiality clause and follows an annual security awareness programme.

Administrators sign in with an email address and password combined with a second factor. That second factor is always on. You can also link an account to Microsoft, so sign-in runs through the existing Microsoft account and user management stays with you. Access through the public API runs on API keys with a fixed scope.

Yes, on request. Our applications are tested every year by an independent party; the most recent penetration test was carried out by ThreadStone. You get the management summary with the status of the follow-up. Request it through the contact form and tell us what you need it for.

Yes, yourself or through an independent third party. We make policy, process descriptions and documentation available for it and follow up on findings, the critical ones first. Because the platform serves several customers, we agree the notice, the scope and the timing beforehand; those terms are set out in the agreement.

Yes. We are a processor of personal data and offer a standard data processing agreement (DPA). It sets out how we handle personal data, how we meet the GDPR and which sub-processors we engage. You can request it through the contact form.

Yes. Every change is in the audit log with its source: HR import, manual, from Entra, by the system or through an API key. The workflow that caused it is recorded alongside, and the log can only be added to, not edited or deleted. That is exactly the overview an ISO 27001 or NIS2 assessment asks of you.

Yes, and we test them. Periodically we actually restore a backup and record the report of it, so the recovery process is demonstrable rather than only described.

We report it to you without delay and at the latest within 24 hours of becoming aware of it, with what we have at that point: what happened, which data and how many people it affects, the expected consequences and the measures we are taking. After that we keep you informed for as long as the incident runs. That leaves you the room to decide within 72 hours whether the supervisory authority needs to be notified.

You can run an import configuration as a dry run first, exporting to Excel what would happen. On top of that, a threshold stops the import as soon as an unusual number of records would change at once. That way a mistake on the source side does not quietly reach your whole organisation.

We hand over the configuration in a readable format, your environment stays available for an agreed period to support the handover, and after that we remove your data from production and from the backups with a written confirmation of deletion. The periods are set out in the agreement.

Through the responsible disclosure section above. We acknowledge your report within three working days, treat it confidentially and keep you informed until it is resolved. Our security.txt is at /.well-known/security.txt.