Security Policy

This Security Policy describes the administrative, technical, and organizational measures Olandiz B.V. uses to protect the Service and
customer/user data. This document is for transparency and does not create contractual commitments beyond applicable agreements.

1. Scope

This Policy applies to Olandiz B.V.’s production systems supporting the Service, including infrastructure, applications, and data stores.
It does not cover third-party services we do not control (see “Third-Party Risk”).

2. Security Governance

• We assign security responsibilities and maintain internal security policies and procedures.
• We periodically review risk and update controls as appropriate.
• Security requirements are considered during design, development, and operations.

3. Access Control

• Least privilege: access is granted based on role and need-to-know.
• Authentication: strong authentication is required for administrative access; multi-factor authentication is used where feasible.
• Access reviews: privileged access is reviewed periodically and revoked upon role changes or departure.

4. Encryption

• In transit: we use TLS for data transmitted over public networks.
• At rest: we use encryption at rest where feasible for sensitive data stores and backups.
• Secrets: API keys and credentials are stored using managed secret storage where feasible, not hard-coded in repositories.

5. Application Security

• Secure development: code reviews, dependency management, and security testing are used to reduce risk.
• Vulnerability management: we track and remediate vulnerabilities based on severity and impact.
• Logging and monitoring: we monitor systems for reliability and suspicious activity.

6. Data Minimization and Segmentation

• We aim to collect and store only the data needed to operate the Service.
• Where feasible, we segregate environments (e.g., development vs. production) and restrict access between systems.
• We restrict administrative actions and sensitive workflows to authorized personnel.

7. Incident Response

• We maintain an incident response process to detect, triage, contain, investigate, and remediate security incidents.
• Where required by law or contract, we will notify affected parties within required timeframes.
• We document incidents and apply corrective actions to reduce recurrence.

8. Backups and Recovery

• We maintain backups and disaster recovery measures appropriate to the Service.
• Backup frequency and retention depend on system criticality.
• We periodically test restoration processes where feasible.

9. Third-Party Risk

• We use vetted service providers for infrastructure and operational needs (e.g., hosting, email, analytics, payment processing).
• We assess providers based on risk and may rely on their security certifications or audit reports where available.
• We limit third-party access to the minimum necessary to provide services.

10. Physical Security

• Where we rely on cloud infrastructure, physical security controls are provided primarily by our cloud providers.
• For any offices where we handle equipment, we apply reasonable access controls and device management.

11. Responsible Disclosure

We welcome good-faith security research. If you believe you’ve found a vulnerability, report it to security@olandiz.com.
Please provide enough detail to reproduce the issue and avoid privacy violations, social engineering, or service disruption.

• What to include: affected URL/system, steps to reproduce, impact, and any proof-of-concept that does not exfiltrate data.
• What not to do: access other users’ data, run denial-of-service tests, or publicly disclose before we have a reasonable chance to remediate.
• Bug bounty (if any): {{BugBountyDetailsOrRemove}}

12. Contact

Security inquiries: security@olandiz.com