SECURITY AND PRIVACY
Confidential stays confidential.
How we protect your documents: from encryption and sign-in to hosting, backups and what we deliberately do not promise.
Encryption with a key per document
Every stored file is encrypted with its own key (age, ChaCha20-Poly1305). Those keys are encrypted with a key per dataroom, and those with a master key that never leaves Scaleway Key Manager. A stolen disk, database export or storage bucket therefore holds only encrypted data.
- Besides the master key there is an offline recovery key, split into three parts of which two are needed. Your data stays recoverable even if the key service fails.
- Deleting means deleting: when a dataroom's keys are destroyed, its content is unreadable. Backups then expire on their own.
- Traffic always uses TLS 1.3, directly to our own server. No intermediary or CDN sits in between that could decrypt your traffic.
Sign-in and access
- Two-factor authentication is on by default, with passkeys or an authenticator app and recovery codes. Sensitive actions ask for the second factor again.
- Guests sign in with a code sent by e-mail; the invitation link alone grants no access. Repeated wrong codes lock access temporarily.
- Permissions per group, folder and document, internal areas external parties never see, expiring access, an IP allow-list and freezing a dataroom.
- Sessions expire after 30 minutes of inactivity.
- Support has no standing access: emergency access needs your approval, lasts at most 24 hours and is recorded.
An audit trail that cannot be rewritten
Sign-ins, views, downloads, uploads and permission changes are recorded in a log with a SHA-256 hash chain, enforced in the database. The log holds identifiers and codes, not file names or content. Every hour a checkpoint is made and every day an encrypted export goes to storage with Object Lock, so not even we can alter the log afterwards.
Safe processing of every file
- Uploads are scanned for viruses (ClamAV) and checked for file type, zip bombs and macros.
- Previews and text recognition are made in an isolated environment without network, with a read-only system and a fresh user per job.
- Files larger than 128 MB are not scanned or previewed; they are marked as not fully scanned and are download-only.
- The viewer shows pages as images with a watermark per viewer (name, e-mail, time and a forensic code). You decide per group whether printing or downloading is allowed.
Where your data is
| What | Where | Provider |
|---|---|---|
| Documents | Amsterdam, the Netherlands | Scaleway (France) |
| Master key | Amsterdam, the Netherlands | Scaleway Key Manager |
| Servers and database | Nuremberg, Germany | Hetzner (Germany) |
| Offsite backup | Falkenstein, Germany | Hetzner (Germany) |
All data stays in the EU, with providers without a US parent company. We use no Cloudflare, no US cloud and no trackers. Our source code is hosted at GitHub and certificates come from Let's Encrypt; neither sees customer data.
Backups
Documents, the audit trail and the database are copied encrypted to a second provider at another location, with Object Lock: even with our own keys those copies cannot be deleted during the retention period. The database is dumped hourly and daily; replication runs every five minutes. We test restoring from that offsite copy.
Retention and deletion
You set retention periods per document class. A legal hold prevents deletion while it applies. After deletion you receive a deletion certificate.
What we deliberately do not promise
No zero-knowledge (see the questions below), no ISO or SOC 2 certification, no SLA percentages and no guarantees we cannot back up. We would rather describe exactly what is in place.
More detail and the evidence per measure are in the Trust Centre.
SECURITY QUESTIONS
Straight answers.
Is The Dutch Dataroom zero-knowledge?
No, and we would rather say so. Documents are stored encrypted, but file names, index titles and search text are in the database, so you can search and the index works. That database runs on our own server in the EU and is reachable only by the application.
Does The Dutch Dataroom hold an ISO certification?
Not yet. We do not claim certifications we do not hold. This page and the Trust Centre describe exactly which measures are in place, so you can judge them yourself.
Who is the data controller?
For the content of your datarooms, your firm is the controller and we are the processor, under a data processing agreement. For your account, billing and this website we are the controller.
Can support look into my dataroom?
Not without your consent. Staff have no standing access. Emergency access needs approval from your firm, is named, lasts at most 24 hours and is recorded in the audit trail.
How do I report a vulnerability?
Via info@thedutchdataroom.com. Our contact details are also in security.txt. We respond to every report and value responsible disclosure.
SEE FOR YOURSELF
Start for free,
no credit card.
Then continue for free with one dataroom, or choose the plan that fits your firm.
Start for free