Trust and security at ISPnext
The security of your data comes first. We maintain a robust security policy and continuously invest in innovative measures to protect customer data against cyber threats. Privacy and security rank high in everything we do.
Certifications and audit assurance
Your data in safe hands with transparent and independent IT certifications and audits.
Read more ›Security
Maximum security through technical measures and an adaptive security culture.
Read more ›Privacy
Responsible handling of personal data, protection and safeguarding of privacy.
Read more ›Independently audited, demonstrably secure
ISO 27001
We have implemented an Information Security Management System (ISMS) that meets the stringent requirements of the ISO 27001 standard. It helps us establish, implement, monitor and improve an effective information security policy, tailored to the specific risks of our organisation. That is how we safeguard the confidentiality, integrity and availability of your data.
Available on request via contracts@ispnext.com: ISO 27001 certificate and Declaration of Applicability.
ISAE 3402 type II
An internationally recognised assurance standard: an independent auditor reviews the internal controls around the security of your data and IT infrastructure. The scope is the hosting and development of the Source-to-Pay platform on Microsoft Azure, based on four processes:
- Development and testing: all new code is thoroughly tested for vulnerabilities and security risks.
- Infrastructure: state-of-the-art Microsoft Azure infrastructure with backups and disaster recovery.
- Security and privacy: strict policies against unauthorised access, in line with the GDPR.
- Logging and monitoring: continuous monitoring for suspicious activity, logs are kept and analysed.
Available on request via contracts@ispnext.com: ISAE 3402 Type II report (NDA required).
FSQS-NL
The Financial Services Qualification System Netherlands certificate confirms that ISPnext meets the stringent norms and standards of the financial sector. For you that is extra assurance that you are working with a reliable and compliant supplier that minimises risks and ensures regulatory compliance.
Microsoft Azure
Our solutions are hosted on Microsoft Azure, with a comprehensive set of security and compliance measures:
- ISO/IEC 27001 and 27018
- GDPR compliance
- Azure Security Center
- Identity and Access Management
- Threat detection and prevention
- Data residency and sovereignty
- SOC 1, SOC 2, SOC 3 audits
- Microsoft Defender for Cloud
- Encryption at rest and in transit
- Multi-Factor Authentication
- Network security and VPN gateways
Continuously monitored, transparently explained
Our ISO 27001 certification independently confirms that we meet the strictest standards for information security. The ISAE 3402 type II assurance report also provides detailed insight into our IT security controls and processes.
We are fully compliant with the GDPR and host your data in the secure Microsoft Azure environment. Our security policy is continuously monitored by the IT Security Board, so our measures are always up to date. We deliberately take a transparent approach and are happy to inform you in detail.
Knowledge and awareness
New employees
From the start we inform new employees about our commitment to security and privacy, with a presentation during induction training and a mandatory information security course.
Phishing tests
We regularly send test phishing emails with tips on recognising and reporting them. Various training courses teach employees to recognise different types of cyber threats.
External expertise and testing
Reputable external specialists periodically scan our infrastructure and software for vulnerabilities. These annual security tests are part of the ISPnext Security Framework and the ISAE 3402 reporting.
Collaboration is essential
By paying continuous attention to security and privacy, and by involving employees in it, we create a secure working environment. Shared responsibility is the best basis for protecting your data.
Careful with your personal data
Privacy legislation (the GDPR) protects the privacy of individuals and limits the permitted use of your personal data. ISPnext processes personal data of customers, website visitors, employees and interested parties, solely on the basis of consent, an agreement, a legitimate interest, or a legal obligation.
Data is only processed for the purpose for which it was obtained and is not retained for longer than necessary. Employees log in with a personal password and are bound by a duty of confidentiality; technical measures protect against external breaches.
Under the GDPR, you have the right to information, access, rectification, erasure, objection, data portability, human review of automated decisions, and withdrawal of previously given consent, among other things. You can submit a request via privacy@ispnext.com; you will hear from us within one month. If you are not satisfied with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens.
Want to know exactly which data we process, on what grounds and for how long we retain it? Read our full privacy policy and cookie statement.
The parties behind our services
Below you will find the subprocessors that ISPnext uses or may use to deliver its services. Some parties only apply when a specific module, integration or project is in use.
| Subprocessor | Service | Location |
|---|---|---|
| Microsoft B.V. | Mail services, storage and virtual infrastructure. | EEA |
| Zendesk | General support system for customer support. | EEA |
| ABBYY | Document recognition (OCR), only within AP Automation when that service is used. | EEA (data centres) |
| Exact Software | Financial administration through Exact Online. | EEA |
| Salesforce | Management of customer data in the CRM system. | EEA |
| Routty | Integrations with ERP systems, depending on the module or the project. | EU/EEA |
| eConnect International B.V. | Integrations with ERP systems, depending on the module or the project. | EU/EEA |
The location refers to the storage and/or processing of data. EEA stands for European Economic Area.
Questions about this list? Contact us at privacy@ispnext.com.
Any questions?
Get in touch with Edward Bakker, our Security Officer. Do you think you have found a security vulnerability? Report it via security@ispnext.com.