Sendsteps gaat zorgvuldig om met je data en probeert dat zo veilig mogelijk te doen. We geloven in transparantie over hoe we beveiliging en dataprotectie aanpakken.
Verkeer in transit is versleuteld met SHA-256 met RSA. Data op onze servers is versleuteld met AWS RDS Encryption (AES-256). Infrastructuur is alleen toegankelijk voor het developmentteam en via VPN. Alle activiteit wordt gelogd en geaudit.
Sendsteps wordt gehost op AWS (Amazon Web Services). Onze infrastructuur staat momenteel in de EU (Duitsland). Data wordt redundant opgeslagen op meerdere locaties in de datacenters van onze hostingprovider.
Sendsteps is ISO 27001-gecertificeerd (Information Security Management System). Bekijk certificaat.
Achtergrondcontroles omvatten een officiële verklaring omtrent het gedrag van de Nederlandse overheid. Medewerkers volgen training over beveiliging en dataprotectie. Sterke wachtwoorden die verlopen, schijfencryptie, en multifactorauthenticatie (MFA) waar mogelijk.
We monitoren performance en beveiliging met infrastructure- en application-monitoringtools. Productie heeft een gecentraliseerde loggingomgeving die security, monitoring, beschikbaarheid, toegang en andere metrics dekt.
De geschatte beschikbaarheid van Sendsteps-diensten is 99,95%, zoals vermeld in Security Standards v2.0. Disaster recovery wordt jaarlijks getest. Data en broncode worden regelmatig automatisch geback-upt.
De Security Standards staan naast deze documenten. Niets hieronder is een samenvatting van een document dat we niet hebben gepubliceerd.
Welke persoonsgegevens we verwerken, op welke rechtsgrond, hoe lang, met welke subverwerkers, en hoe je je rechten kunt uitoefenen. Versie 2.1, 4 augustus 2026.
De voorwaarden die gelden voor Free Services en Paid Services, inclusief gegevensverwerking (clausule 10). Versie 15, van kracht vanaf 30 oktober 2024.
De cookiecategorieën die Sendsteps gebruikt (Essential, Functional, Analytical, Tracking) en de Cookiebot-verklaring van cookies in gebruik.
Sendsteps is ISO 27001-gecertificeerd. Het certificaat dekt ons Information Security Management System (ISMS).
Bekijk ISO 27001-certificaat (PDF) →
We verwerken persoonsgegevens als Controller of Processor in de zin van de EU-AVG. Privacy zit in het platform, niet achteraf toegevoegd. Vragen gaan naar onze Data Protection Officer.
Lees de privacyverklaring (EN) →
The full Sendsteps Security Standards. Version 2.0, 3 April 2026. Internal links in this document point to the privacy statement (EN) and terms of service on this site.
Sendsteps handles your data and tries to do that in the most secure way possible. When speaking about data we discern the categories as described in our privacy statement (EN).
As a company Sendsteps firmly believes in transparency both in a business as well as in a security context. We always try to be as open and clear as possible in the way we handle both security and (data) privacy. If you are looking for more information on how we treat your personal information or information about the third-parties we work with please have a look at our privacy statement (EN).
In this document we give you a look into our organization and the way we put our security and privacy policy in practice.
In our Terms and Conditions (EN) we guarantee to keep your account and personal data confidential. However, as also described in our Terms, if you use our "Free" version, all data we gather can be used for promotion purposes, on our website and can be shared with third parties. If you want your data to be handled in a more secure way we highly recommend using our of our paid plans.
Our staff and third parties, anyone of whom needs to work with your data is contractually obligated to keep that confidential.
As a company we place the greatest amount of importance on making sure the highest possible level of security is in place. Our staff plays an important role in this, therefore we have placed strict controls over our staff and all our processes.
When hiring a new staff member we perform background checks during the hiring process. Including an official statement of good behaviour granted by the Dutch government. When hired each staff member is required to take a security and data privacy training with our Security Officer. During said training the focus is on how to work securely using both our own tools as well as the tools we use from third parties, handling sensitive information (including your personal data). Physical security as well as general security best practices are also covered.
Working at Sendsteps means for some employees that they need to have access to systems that store and process sensitive data. For example, if something went wrong with your payment we may need to access your personal data in order to diagnose the problem. Sendsteps and her employees are committed to making sure that sensitive data is never seen by anyone who doesn't need access to it. We use restrictions on the application layer to make sure that each member of staff only has access to the data that is needed to perform their jobs. These employees are prohibited from using these permissions to view sensitive our personal data unless it is necessary to do so.
Sendsteps performs regular internal audits to make sure we adhere to our own high security standards. Additional checks are made when an employee leaves the company. Also we force every employee to use strong passwords that expire and disk encryption. Multi-factor authentication (MFA) is used wherever possible.
When using Sendsteps, it is possible to export your data through our dashboards.
Upon request of our customers it is possible to delete the data of a specific event. We will process this request when it comes it, usually within 24 hours. Our customer support will happily provide you any sort of assistance necessary.
Sendsteps is hosted on AWS (Amazon Web Services) infrastructure. Currently, our infrastructure is located in the EU (Germany).
Amazon Web Services maintains multiple certifications for its data centres, including ISO 27001 compliance, PCI Certification, and SOC reports. For more information about their certification and compliance, please visit the AWS security website and the AWS compliance website.
When it comes to our server architecture we use a tiered model that keeps services and functions as much as possible within the specific tier.
Sendsteps uses the latest available suites and protocols to encrypt (SHA-256 with RSA Encryption) all traffic in transit. Your data on our servers is encrypted (AWS RDS Encryption - AES-256) as well, our infrastructure is accessible only by the development team and through VPN. All activity is logged and audited.
We closely monitor any changes in the cryptographic landscape work promptly to upgrade our products to respond to new cryptographic weaknesses as they are discovered and implement best practices as they evolve. For encryption in transit, we do this while also balancing the need for compatibility for older versions of commonly used browsers.
Approximate availability of Sendsteps services is at 99.95%. Our infrastructure runs on systems that are fault tolerant of failures of individual servers. Sendsteps' quality assurance team tests disaster recovery measures on an annual basis.
Your data is stored redundantly at multiple locations in our hosting provider's data centres to ensure availability. We have well-tested backup and restoration procedures, which allow recovery from a major disaster. Both your data and our source code are automatically backed up on a regular basis.
We closely monitor both performance as well as security of our products and services. We use infrastructure as well as application monitoring tools. In combination with specialized tools for analysis and data visualization, it gives us strong insights about the condition our services are in. Sendsteps has an extensive, centralized logging environment in its production environment which contains information pertaining to security, monitoring, availability, access, and other metrics about our whole range of products.
In development we follow our own implementation of Agile/Scrum methodology. We frequently release new versions of our products and continuously change our workflow based on evolving needs and the lessons drawn from the past.
All our software is tested extensively by our quality assurance team. These checks are performed both manually as well as automated. Newly created code is peer reviewed and only put live it meets a set of pre-defined requirements.
New code is deployed to our staging environment first. There a set of automated tests as well as manual test are run to ensure the best quality possible. If everything works as expected, the new feature is put live. In case of emergencies, serious bugs or if anything else goes wrong, we are able to release a fix for the problem within the hour.
In the unlikely event of a security breach, Sendsteps will promptly notify you personally of any unauthorized access to your data. We have incident management policies and procedures in place to handle such an event.
On a regular basis Sendsteps' systems are audited by respected external security firms to ensure that our practices stay on par with current security standards. On request we can provide you with the most recent report of these audits.
Alleen gepubliceerde documenten. Gegevensverwerking staat in clausule 10 van de Gebruiksvoorwaarden (EN). Subverwerkers staan in de privacyverklaring (EN). Externe security-auditrapporten zijn op verzoek beschikbaar via legal@sendsteps.com.
Vragen over hoe we persoonsgegevens verwerken gaan naar onze Data Protection Officer. Juridische zaken, inclusief een verzoek om het meest recente externe security-auditrapport, gaan naar legal@sendsteps.com.