Security Statement

Last updated: 9 July 2026

This Security Statement gives a plain-language overview of the measures we use to protect OurDigitalContract and the data you entrust to us. It is a summary; the legal arrangements for the processing of personal data are set out in our Data Processing Agreement.

Encryption at rest

We store sensitive personal data, including citizen service number (BSN), IBAN, date of birth, contracts and files, encrypted with AES-256-GCM. Each customer has its own key, which is derived using HKDF. The encryption includes an integrity binding, so that data cannot be swapped or moved between customers unnoticed.

Passwords and email addresses

We do not store passwords as readable text, but as a bcrypt hash. Email addresses in the central register are HMAC-indexed, so that we can look them up without storing them in a readable form unnecessarily.

Encryption in transit

Traffic between your browser and the platform runs over HTTPS/TLS. Certificate management is handled automatically by Caddy, so that the connection always uses a valid certificate.

Access and account security

We limit and protect access to the platform in several ways:

• Sessions run through HttpOnly and SameSite cookies.
• We apply a strict Content Security Policy and additional security headers.
• Login is protected with rate limiting to counter misuse and automated attempts.
• Two-factor authentication is available in the login flow.

Role-based access and logging

Access to data is role-based: users only see what fits their role. For read roles, sensitive fields are masked. Important actions are recorded through audit logging. Where needed, we can revoke a session or deactivate an account.

Backups

We make regular backups of the data. We deliberately store the encryption key separately from the backups, so that a backup on its own does not reveal readable data.

Hosting and location

The platform runs in the Netherlands (EU) at TransIP. Data stays within the EU, except for the exceptions described in our Data Processing Agreement and our list of sub-processors.

External certification

OurDigitalContract does not currently hold an external security certification such as ISO 27001. We take the measures above because we consider them appropriate and responsible for the data we process; the absence of a certificate does not mean that security is not a priority for us.

Data breaches

If, despite our measures, something does go wrong with personal data, we act in accordance with our data breach procedure.

Responsible disclosure of vulnerabilities

Have you discovered a possible vulnerability in the platform? Please report it responsibly to support@ourdigitalcontract.com. We do not promise a reward, but we treat every report seriously and are grateful that you help us make the platform safer. We ask you not to exploit the vulnerability and not to share it with others before we have been able to resolve it.

Changes

Security is ongoing work. We may amend this statement when our measures change. The current version is always available on this page.