This policy describes how Appfront secures information: our own, that of our clients and that of the end users of the systems we build and manage. It applies to all our employees, contractors and partners and forms the framework within which we implement technical and organisational measures.
Appfront B.V. designs, builds and manages custom software for clients in sectors including finance, healthcare, industry, mobility and the (semi-)public sector. Much of the information we process on behalf of clients is sensitive: personal data, trade secrets, source data from business processes and integrations with core systems. Information security is therefore not an optional layer, but a prerequisite for our services.
This information security policy describes the principles we apply, the normative framework within which we work, the technical and organisational measures we take, how we handle client data and incidents, and what you can expect from us as a client, partner or reporter. The policy applies to all employees, freelancers, interns and contractors working on behalf of Appfront, and to all systems in which we process data: our own infrastructure, development environments, and client environments we manage, to the extent contractually agreed.
The policy is a living document. We update it whenever legislation, standards or our operations require it, with a fixed annual review as a minimum. Changes are published on this page, stating the version date. For clients and auditors who wish to cite this policy in vendor onboarding or a risk assessment, the version on this page at the time of consultation applies. Questions about how this policy applies to a specific engagement or audit can be sent to security@appfront.nl.
Confidentiality, integrity and availability are the three pillars against which we weigh measures. Every decision about architecture, access or storage is explicitly assessed against all three criteria, not just one of them.
Employees, systems and applications receive only the permissions strictly necessary for their task. Security is built in layers, so that the failure of one layer does not immediately lead to an incident and attackers face multiple hurdles.
Privacy and security are considered from the very first design, not added afterwards. Default settings are restrictive: data fields are hidden by default, endpoints are not public by default, accounts have no permissions by default, and these are only extended when a use case justifies it.
The General Data Protection Regulation (EU 2016/679) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG) form the primary framework for processing personal data. We apply its principles of lawfulness, purpose limitation, data minimisation and transparency.
The NIS2 Directive (EU 2022/2555) and the Cyber Resilience Act (EU 2024/2847) set requirements for appropriate security measures, incident reporting and the security of digital products throughout their lifecycle. We build our process around these wherever they apply to us or our clients.
For healthcare clients, we follow NEN 7510 for information security in healthcare. For government projects, we apply the Baseline Informatiebeveiliging Overheid (BIO). For financial clients, we align with the requirements of DORA (EU 2022/2554) on digital operational resilience.
We work according to the structure of ISO/IEC 27001 (information security management) and align with ISO/IEC 27701 (privacy information management). Formal certification is in preparation; until then, we carry out internal audits based on the relevant controls.
The technical controls below form the baseline of our security. For clients with additional requirements (for example, with ISO 27001-compliant software or NEN 7510 projects), we extend this according to contractual agreements.
AES-256 or stronger for data at rest, TLS 1.3 for data in transit. No unencrypted transport.
SSO via Microsoft Entra, mandatory MFA, role-based access control on all business systems.
Centralised logging with alerting on anomalous patterns. Logs are stored separately from the production environment.
Regular review of updates, with priority for critical CVEs. Auto-update where it is safe to do so.
Encrypted, geographically separated backups. A regularly tested restore procedure as part of disaster recovery.
MDM on all work devices, full-disk encryption, anti-malware and remote wipe in case of loss or theft.
Segmentation between environments, firewall policies, VPN for remote access and zero trust where possible.
Credentials are kept in a vault, never in version control. Rotation on a fixed schedule and whenever staff change.
Continuous scanning of dependencies and container images (SCA and SAST) as part of the build pipeline.
Regular externally conducted penetration tests on production systems and core applications, with follow-up in a fix backlog.
Peer review on every change, automated checks in CI/CD and security issues as blocking criteria for releases.
Production environments follow documented baselines, with minimal attack surfaces and default accounts disabled.
Appfront's CEO, Fabian van Dijk, is ultimately responsible for information security and acts as security officer. He directs policy, risk analysis and incident handling, and is the central point of contact for clients and regulators.
Every employee and contractor signs a confidentiality agreement on joining and regularly completes security and privacy awareness training. For sensitive projects or at a client's request, we carry out appropriate screening in line with the legal framework.
Production changes go through peer review and, where necessary, a formal change procedure. Sub-processors are assessed for a demonstrable level of security (for example ISO 27001, SOC 2 Type II or an equivalent standard) before they are given access to personal or client data.
Our client is and remains the data owner of the data processed on their behalf. Appfront acts as processor within the meaning of Article 28 GDPR, unless agreed otherwise in the contract. With every client for whom we process personal data, we conclude a data processing agreement (DPA) based on our standard text or, if the client prefers, on their own template after review of its content.
Data residency: data is processed within the European Economic Area. For this we use EU regions of established cloud providers (AWS, Azure, Google Cloud) and European hosting providers (such as Hetzner). Data transfers to third countries take place only on the basis of a valid transfer mechanism such as Standard Contractual Clauses (SCCs) and an additional risk analysis (Transfer Impact Assessment).
Client data is not used to train general-purpose AI models or resold to third parties. For AI applications we build on commission, additional agreements apply: which models, on which data, with what logging and what retention. Retention periods follow the contract and applicable legislation; when an engagement is dissolved or terminated, client data is deleted within ninety days by default, unless statutory retention obligations require otherwise or the client explicitly requests longer retention.
Incidents are detected through monitoring, external reports or our CVD process. All reports come together at a single central address and are triaged immediately by the responsible security team.
When an incident affects, or could reasonably affect, a client, we notify that client confidentially as soon as possible, in line with the agreements in the data processing agreement and no later than the period stated there.
When an incident qualifies as a data breach that a processor must report to the controller, we comply with the deadline set out in Article 33 GDPR. The client then assesses whether notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects is required.
For external vulnerability reports, we apply a separate CVD policy. It sets out how researchers can responsibly report a vulnerability, what they can expect from us and what safe harbour we offer.
At least once per calendar year, we carry out an internal audit of how this policy and the associated controls are working. Findings are prioritised and followed up in an action plan, with ultimate responsibility resting with the security officer.
Clients with whom we have concluded a data processing agreement have an audit right within the framework described there. On reasonable request, we provide evidence of controls, such as logs, dashboard extracts and architecture documentation, under a confidentiality agreement.
We are working towards formal certification under ISO/IEC 27001 and aligning with the privacy extension ISO/IEC 27701. Until certification is complete, we apply the same controls and, on request, transparently make the scope and status available.
Certain categories of data require additional safeguards. For engagements in which such data plays a role, for example with a GDPR compliance platform, we lay down the specific measures contractually.
Processing in accordance with GDPR Art. 9 and NEN 7510, with stricter access control and logging.
Processed only on an explicit contractual basis, with a deliberate choice for hashing or vectorisation where possible.
Only processed with a lawful basis and strict role separation; never by default in a production environment.
Processing only with an appropriate lawful basis, with parental or guardian consent where the GDPR requires it.
For clients subject to DORA or PSD2, we align security, monitoring and reporting lines with that client's regime.
BIO-compliant measures, classification in line with government standards and strictly EU-only hosting where the assignment requires it.
Client data is never used for training without explicit consent. Anonymisation and aggregation are the default.
For all categories under GDPR Art. 9, the following applies: an enhanced lawfulness assessment, minimal access and strict logging.
This policy has a single owner: Appfront's security officer. He is responsible for establishing, maintaining, communicating and enforcing the policy. Changes are recorded in a change log and are available to clients and auditors on request.
The policy is reviewed at least once a year, and additionally in the event of relevant changes in legislation and regulations, in our infrastructure, or after a significant incident. The next regular review is scheduled for May 2027. Earlier reviews are listed in the change log.
Risks are recorded in a risk register and periodically reassessed based on changes in our portfolio, the threat landscape and the sub-processors involved. High-risk areas receive additional measures; residual risks are explicitly accepted by the security officer.
For substantive questions, vendor onboarding, an audit request or an incident report, you can contact our security officer. We treat serious requests confidentially and confirm receipt within five working days.
Appfront uses cookies and similar technologies to make the website work properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
