Security and privacy
Trust Center
You trust us with employee data. Here we explain our approach to security, access, monitoring and data processing. We can also help with security reviews and procurement questions.
In short
Documents you can request
Some you can download above. We send the rest as soon as you ask, through the contact form or [email protected]. Tell us what you need it for and we send the right version straight away.
| Document | What it covers |
|---|---|
| Statement of Applicability | Which ISO 27001 controls we have in place, and which do not apply and why. |
| Data processing agreement | The agreement between you as controller and us as processor, including the register of sub-processors. |
| Pentest management summary | The outcome of the most recent external penetration test and the status of the follow-up. |
| Business continuity summary | What we do when the platform, the hosting provider or key people are unavailable, and in a ransomware scenario. |
| Restore test report | The report of the yearly test in which we actually restore the platform environment. |
| Completed security questionnaire | If you have your own questionnaire or security annex, we fill it in. Technical details go into the design of the integration. |
Standard answers for a questionnaire
The short answer per topic. The explanation is in the questions further down.
| Topic | Answer |
|---|---|
| Certification | ISO 27001, audited externally every year by DigiTrust. No ISAE 3402 or TPM; a yearly evidence set instead. |
| Role under the GDPR | Processor. Standard data processing agreement, data protection officer in place. |
| Data location | Data centre in Amsterdam, inside the EU. The hosting provider is ISO 27001 certified and has a SOC 2 Type II report. |
| Encryption | In transit with TLS, at rest with AES-256. Logging and credentials additionally encrypted in the application. |
| Separation between customers | Enforced per organisation in the data layer, own credentials per customer integration. Tested in the pentest. |
| Staff access | Personal accounts, least privilege, MFA mandatory, periodic review, revoked immediately on leaving. |
| Signing in to the platform | Microsoft Entra ID (SSO) or password with two-factor authentication. Roles per user. |
| Logging | Every run and every change per employee. Retention set per integration, up to twelve months. |
| Backup and recovery | Separate from production and immutable within the retention period. Yearly restore test. |
| Data breach | Reported without delay and within 24 hours of discovery at the latest. |
| Vulnerabilities | Automated scans on every build, alerts on new CVEs, yearly external pentest. |
| Development | OWASP, separate test and production environments, deployment only through the pipeline, mandatory review for sensitive changes. |
| Audit by the customer | Possible, by agreement on notice, scope and timing. |
| End of contract | Configuration and audit logging in a readable format, then deletion with a written statement. |
Certification and audits
Is KoppelHet ISO 27001 certified?
Yes. We have an ISO 27001 certified information security management system. DigiTrust audits it externally every year, and we audit it internally every year as well. You can download the certificate at the top of this page; we send the Statement of Applicability on request.
Do you have an ISAE 3402 report or third-party statement (TPM)?
No. For an organisation of our size, such an assurance report is out of proportion to the risk. Instead we deliver a fixed set every year, within a month of the external audit. The current ISO 27001 certificate with its scope, the Statement of Applicability, the management summary of the external audit including open findings, and the management summary of the pentest with the status of the follow-up.
How do you manage information security risks?
We assess the risks around customer engagements every year and at every significant change to the service. The measures are set out in the management system. If we temporarily deviate from an agreement with you, we report it in writing, with the cause, the residual risk, the interim measures and a date for resolution.
Can we run our own audit or pentest?
Yes, yourself or through an independent party. We provide policies, process descriptions and documentation and follow up findings, critical ones first. Because the platform serves several customers, we agree notice, scope and timing in advance. The test only touches your environment and data.
Hosting and data location
Where is our data stored?
All platform data and resources are in a data centre in Amsterdam, inside the EU. Production data does not go to any environment outside the EU.
Is the hosting provider certified?
Yes. Our hosting provider is ISO 27001 certified and has a SOC 2 Type II report for this service. We send the documentation on request.
Is our data separated from other customers' data?
Yes. The platform serves several customers, and separation per organisation is enforced in the data layer, not just in the screens. Each customer integration has its own credentials, never shared between customers. Settings and mappings are data, not code running per customer. The separation is part of the yearly pentest.
How available is the platform?
We monitor the platform 24/7. Average uptime is 99.9 percent, with a minimum of 99.7 percent. If a system is briefly unreachable, no changes are lost. The integration picks them up once the system is reachable again.
Encryption and credentials
Is data encrypted?
Yes. All traffic uses TLS, current versions only. Stored data is encrypted with AES-256. On top of that the platform encrypts the content of the logging and the credentials of integrations again in the application itself. Keys are managed separately from the data.
Where are the credentials for our systems stored?
Encrypted in the platform, per integration and per customer. Where a system supports it we use OAuth 2.0 with a limited scope instead of a password. Our team's internal keys and passwords are kept in a password vault, never in code or in a file.
What rights does the integration get in our systems?
Only what the integration needs. For each system we use a dedicated system account or API key, which you issue and can revoke at any time. If a change needs more rights, such as an extra scope, it only goes live after a second developer approves it, and we ask you first.
Does our data end up on laptops or in files?
No. Exporting to local files is not part of our work. Our laptops are fully encrypted and centrally managed, with endpoint protection users cannot switch off. When we retire a device, we wipe it centrally.
Access and MFA
Who at KoppelHet can access our data?
Only the people working on your integration. They use personal accounts under least privilege; we do not use shared accounts. We review who has which access periodically. When someone leaves, access is revoked the same day. Everyone is bound by confidentiality and follows a yearly security awareness programme with phishing simulations.
Is MFA mandatory?
Yes, for all our staff accounts, in the office and remotely, and for access to customer environments. Admin rights on production are not permanent. They are granted per task, limited in time and logged. MFA does not work for system accounts that do not sign in interactively; those get a limited scope, encrypted storage and logging of every use instead.
How do our employees sign in to the platform?
With their Microsoft account through Entra ID, so user management stays with you. Or with email address and password. Two-factor authentication is then mandatory for administrators; other users can switch it on themselves. We only store passwords as a one-way hash and repeated failed attempts are blocked.
Logging and monitoring
What is logged?
Every run of an integration with start, end, counts and errors, and per employee which fields changed, with the value before and after. Also sign-ins, admin actions and changes to settings and mappings. Every entry has a timestamp, who or what performed the action and the outcome. The content of the logging is stored encrypted.
How long do you keep logs?
You set it per integration, from one to twelve months. The default is one month. After that the platform deletes the logging automatically. In a security incident we keep the relevant logs longer, so an investigation remains possible.
Can we feed the logs into our own SIEM?
Not directly. We can provide the security and audit logs as JSON, through a secured API or as a periodic export. You then set up the ingest into your SIEM. We build that as a separate change, based on the use cases that matter to you.
How do you notice when something goes wrong?
We monitor the platform 24/7 and are alerted automatically on technical errors. If a change cannot go through, your administrator gets a notification with the reason. Anyone who wants it also gets a daily report per integration at a time they choose.
Backup and continuity
Do you make backups, and do you test restoring them?
Yes. Backups are kept separate from production, with their own credentials, and cannot be changed or deleted within the retention period. Once a year we actually restore the platform environment and record it in a report, which you can request.
Is there a business continuity plan?
Yes, as part of the ISO 27001 system. For each scenario it sets out the recovery steps, the roles and the communication to customers. The scenarios are loss of the platform, loss of the hosting provider, loss of key people, and ransomware.
Do we lose data if the platform goes down?
No. An integration is not a register of its own. The data stays in your HR system and your target systems. Recovery means running the integration again from the source, not retrieving lost data.
What recovery time do you agree to?
It depends on how critical the integration is. A payroll integration around the pay run needs something different from an integration to the service desk. We set the recovery time and the maximum data loss for the configuration per integration in the design and the agreement.
Incidents and data breaches
What happens in a data breach?
We notify you without delay and within 24 hours of becoming aware of it at the latest. You hear what happened, which data and how many people are affected, the expected consequences and the measures we are taking. That leaves you, as controller, room to decide within 72 hours whether to notify the Dutch Data Protection Authority.
How do you handle a security incident?
We assess the incident quickly and act immediately on a suspected data breach. If it affects you, we notify you within 24 hours and then update you at least daily while it runs. We preserve the relevant logs for investigation and bring in a specialist party where needed. We close with a written evaluation and improvements. We record security incidents separately from ordinary incidents.
How do we set up the reporting path?
At the start of a project we record who is alerted on both sides, with names and phone numbers. We keep that list up to date when people change.
Vulnerabilities and pentests
How do you keep the software secure and up to date?
On every build we scan the components we use for known vulnerabilities. A critical finding blocks the deployment. We are alerted automatically when a new vulnerability is published in something we use, and we check the public side of the platform from outside periodically. Critical vulnerabilities are patched or shielded with priority. If it affects you, you hear it from us.
Is the platform pentested?
Yes, every year by an independent external party. The most recent test was carried out by Threadstone. We fix findings and have them retested. We send the management summary with the status of the follow-up on request.
Are you protected against DDoS attacks?
Yes. The public side of the platform sits behind a layer with DDoS protection and a web application firewall, and the API has rate limiting. An integration also runs in the background. If the platform is briefly unreachable, no data is lost.
Secure development
How do you ensure secure development?
We develop according to the OWASP guidelines, with static analysis and security checks in the pipeline. Nobody puts code straight on production. Changes go to a separate test environment first and then through the pipeline to production. The infrastructure is defined in code, so manual changes on production are overwritten at the next deployment.
Does a second developer always review changes?
For everything that affects more than one customer, yes. That covers the framework all integrations run on, the shared API clients per vendor, anything to do with credentials or rights, and every integration with a new party. This is enforced technically and traceable per change for the audit. A change to one customer's integration goes without a second review, because it only affects that customer.
Do you use production data for testing?
Not in the development environment; there we use fictitious or pseudonymised data. Sometimes testing with real data is needed, for example in a parallel pay run. We agree that with you in advance and record it in the data processing agreement, with the same security as production and deletion afterwards.
Privacy, GDPR and sub-processors
What are our roles under the GDPR?
You are the controller, KoppelHet is the processor. We only process data for the purpose in the data processing agreement. We have a data protection officer and run periodic checks. We send the standard data processing agreement on request.
What data does an integration process?
Only the fields the target system needs. They are listed field by field in the design you approve in advance. We do not keep a register of our own. The platform fetches data, transforms it and passes it on. What it holds temporarily disappears with the log retention period.
Which sub-processors do you use?
As few as possible, and only for parts of the service such as hosting. They are all listed in the register of sub-processors that comes with the data processing agreement and are bound by the same requirements as we are.
End of the relationship
What happens to our data when the contract ends?
We hand over the full configuration in a readable format, with mappings, translation rules and setup documentation, and the audit logs as JSON. Your environment stays available for an agreed period for the handover. After that we delete your data from production and from backups, with a written statement. The periods are in the agreement. Your HR data itself is in your own systems and stays there.
Reporting a vulnerability
If you have found a vulnerability in the platform or this site, let us know at [email protected], with enough information to reproduce it. Do not exploit it and do not share it with others until it is fixed. We treat your report confidentially and keep you informed.
Implementation and architectureHow the platform worksHow we work