The number one for certification in the Netherlands

Trust Center

How we protect your information, where we store it and which services we work with.

Last updated on 19 October 2026

Frameworks

Our measures follow the principles of these standards. We are currently not certified. Some parts that are only needed for a certificate are still missing, such as an internal audit and a management review.

GDPR European privacy law, handling of personal data
ISO/IEC 27001 Information security
ISO 9001 Quality management
ISO/IEC 42001 Responsible use of AI

Documents

Measures

Privacy (GDPR)

Transparency: our privacy policy describes which data we use and why.
We do not sell personal data.
You can exercise your GDPR rights, such as access, correction and deletion, via info+dpo@certificeerwijzer.nl.
We keep a record of processing activities for what we do with personal data.
Data processing agreements apply to our sub-processors, see the table below.
We only share your request with providers once you agree in the last step of the request.
Data breaches: we record and investigate every incident. Where personal data is involved, we always assess whether we must report it to the Dutch Data Protection Authority, and if so, we do so within 72 hours.
Transfers outside the EU only take place with safeguards, such as standard contractual clauses and the EU-US Data Privacy Framework.

Information security (ISO 27001)

A selection of the Annex A controls that are relevant to us now.

Measure	What we do	ISO 27001
Encryption	All connections over HTTPS with HSTS, and encrypted backups.	A.8.24
Passwords and keys	Kept in a managed vault, with minimal permissions per key. We rotate a leaked key immediately and report it as an incident.	A.5.17, A.8.24
Two-factor authentication	Mandatory for staff.	A.8.5
Limited access	Staff only have access to what they need. Requests can only be reached by our server functions, not through the public database API.	A.5.15, A.8.3
Network and firewalls	Vercel WAF with bot protection, firewall and brute-force protection on our servers, server management via a private network.	A.8.20, A.8.21
Personal link	The code in your personal link sits after a hash sign (#), so it does not end up in server logs. The database only holds a hash of that code.	A.8.5
Forms and attachments	The server checks all input again, Vercel BotID stops automated abuse and attachments are checked for file type, number and size.	A.8.26, A.8.28
Security headers	CSP, HSTS, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on the website. Other websites cannot embed our pages.	A.8.26
Backups	Daily, stored encrypted at a separate location, plus weekly snapshots of the servers.	A.8.13
Monitoring	Alerts when the website is down.	A.8.16
Incidents	Every incident is recorded, investigated for its cause and followed up with improvements.	A.5.24 to A.5.27
Vulnerabilities	Automatic alerts for vulnerable dependencies.	A.8.8
Change management	Changes go through a pull request on a protected main branch.	A.8.25, A.8.32
Suppliers	An overview of our subprocessors, with a link to their data processing terms.	A.5.19, A.5.20
Source code	Kept in a private environment with mandatory two-factor authentication.	A.8.4
Test and production	Changes are first tested in a separate preview environment.	A.8.31
Configuration	Monitoring of deviating server settings and changes to the firewall.	A.8.9
Recovery	A recovery plan aiming for at most 24 hours of data loss and recovery within about 2 hours.	A.5.30
Security reports	Report a security issue confidentially via info+security@certificeerwijzer.nl.	A.6.8
Overview of systems	A register of our company assets.	A.5.9

Quality (ISO 9001)

A selection of the requirements that are relevant to us now.

Measure	What we do	ISO 9001
Documented way of working	Our way of working is recorded in a handbook with version control and fixed procedures.	7.5, 8.1
Complaints and incidents	Quality incidents and complaints are registered and followed up.	10.2
Improving	Improvements are tracked as tasks with an owner and a schedule.	10.3
Evaluating	We discuss results and improvements every week in a fixed weekly kick-off.	9.1
Suppliers and tools	New tools are evaluated before we use them.	8.4

AI (ISO 42001)

A selection of the Annex A controls that are relevant to us now.

Measure	What we do	ISO 42001
New AI tools	Are evaluated before we use them.	A.10.3
Business plan	Our team uses Claude under a business Team plan, with Anthropic’s data processing addendum. Under the business terms, Anthropic does not train on our data unless we choose to allow it.	A.10.3

Subprocessors

Third-party services that process data on our behalf, with their purpose, the data, where the data is stored and where the company is based.

Subprocessor	Purpose	Data	Data location	Company location	Data processing agreement
Supabase	Database	The saved progress of requests: contact details and answers	EU	Singapore	View
Vercel	Hosting and AI gateway	Website traffic and form requests, and uploaded documents read via the AI Gateway (zero data retention)	EU, US	US	View
Resend	Email delivery	Email addresses and message content: your request, confirmations, your personal link and the newsletter	US	US	View
Hetzner	Server hosting for customer relations, statistics and content management	Contact details and requests in our customer relationship system and website statistics	EU	EU	View
Google Workspace	Business email	Requests, attachments and messages that arrive at info@certificeerwijzer.nl	EU, US	US	View
Anthropic	AI assistant for our team (Claude, business Team plan)	Texts and code that our team gives to Claude	US	US	View

Frequently asked questions

Can I have information changed or deleted?

Yes. Email us via info+dpo@certificeerwijzer.nl and say which request or message it concerns. The privacy policy describes your rights and how long we keep data.

Where can I find the privacy policy?

Which data we collect, what we do with it, how long we keep it and what your rights are is described in our privacy policy. There you can also read about cookies and statistics.

How do I report a security issue?

Email us confidentially at info+security@certificeerwijzer.nl. Describe what you saw and how we can reproduce it. Do not access or change other people’s data.