Encryption
Data is transmitted encrypted via TLS (HTTPS). Passwords are stored hashed (bcrypt) and two-factor secrets encrypted (AES-256-GCM).
Access control
Access is restricted on a least-privilege basis, with authentication and logging. Important changes to accounts and cases are recorded in an audit log.
Data minimisation
We do not ask for a BSN and only process data needed for the calculation.
Infrastructure
We host with Amazon Web Services in the EU (Ireland region).
Payments
Payments are processed by Stripe (PCI DSS certified). You enter your card details with Stripe; we do not store them ourselves.
Compliance
Our measures are designed with the GDPR in mind.
Responsible disclosure
Do you think you have found a vulnerability? Please report it responsibly and give us the opportunity to resolve the issue before disclosing it publicly. Do not exploit the vulnerability and do not delete any data.