Security

1. Account and access

Passwords are stored with Argon2 hashing, must be at least 12 characters, and repeated failed sign-in attempts are limited.

Office users enter a 6-digit code from an authenticator app on their phone in addition to their e-mail address and password. Workers and Client contacts sign in with e-mail address and password only.

Every session activates exactly one role, a session ends after a period of inactivity, and authorization is enforced on the server for every request.

2. Data protection

Traffic is protected with TLS in production, files are stored privately and served only through authorized downloads, and consequential actions are recorded in an append-only Audit log.

3. Infrastructure and operator access

The application runs as a hardened container with a PostgreSQL database in the European Union; secrets are supplied through mounted files and never stored in the code base.

The supplier's developers look into production only with Synthetic Test Agency B.V.'s approval each time, and everything they do there is recorded.

4. If a personal-data breach happens

The supplier notifies Synthetic Test Agency B.V.'s AVG contacts of a personal-data breach, where feasible within 48 hours of confirming it.

Synthetic Test Agency B.V. decides whether the Autoriteit Persoonsgegevens and the people concerned are notified.