Security & privacy

When you work with us, you share information about your customers, your sales process and your systems. This page explains how we protect that information. We organise our information security according to the principles of ISO/IEC 27001:2022. We are not ISO certified, but we keep our own register of systems, risks and measures, which we review every six months.

Website and domain

• Always encrypted. The website only works over https, with an automatically renewed certificate. Browsers are told never to connect without encryption (HSTS).
• Signed domain name. vanderwalt.eu is protected with DNSSEC, so nobody can quietly send visitors to a fake website.
• Security headers. The website sends headers that protect against clickjacking and files being run the wrong way, among other things.
• Email you can verify. Our domain uses SPF, DKIM and DMARC, so receivers can check that an email from @vanderwalt.eu really comes from us.
• Tested with internet.nl. We regularly check our website and email with the independent internet.nl test.

Forms and your data

Forms on this website are processed on our server, not by third-party form services in your browser. Your details go to our CRM (HubSpot) and, if you sign up for follow-up emails, to Brevo. Both store data in the European Union, and we have a data processing agreement with each of them. Cookies for analytics and chat are only set after you give consent. Which data we process and how long we keep it is described in our privacy policy.

Our workplace

• Disk encryption on the work computer, automatic security updates and immediate screen lock.
• Client data is kept only in business systems (CRM, business email), never in personal storage or on USB sticks.
• Access to the web server only with a personal SSH key, not with a password.

Working in your systems

When we set up HubSpot, Dynamics 365 or another environment for you, we use our own account with only the permissions we need, and we ask you to revoke that account when the project ends. We don't export client data to our own systems unless the work requires it and we have agreed on it together. On request, we sign a data processing agreement with you.

If something goes wrong

We have a fixed procedure for incidents, such as a lost laptop or a hacked account. If personal data is involved, we report the breach to the Dutch Data Protection Authority within 72 hours and inform you if you are affected.

Found a vulnerability?

Have you found a weakness in our website or systems? Please report it to rick@vanderwalt.eu. Tell us what you found and how we can reproduce it. Don't make the vulnerability public before we have been able to fix it, and don't use it beyond what is needed to demonstrate it. We respond within five working days. Our contact details for security reports are also in security.txt.

Questions?

Would you like to know more, for example for a supplier assessment or an information security questionnaire? Email rick@vanderwalt.eu. We update this page when our measures change.