Skip to content

Security

Security policy

How ITLedger handles security and vulnerabilities.

Security policy – ITLedger (Brainforge B.V.)

This is an English translation of the Dutch Beveiligingsbeleid. If the two versions differ, the Dutch version prevails.

Status: draft under review. This page describes our current security approach and is continuously reviewed legally and substantively. Changes following specialist advice are possible.

Effective date: 1 January 2026. Dutch text updated on 12 October 2026.

Summary

We take reasonable and proportionate measures to protect the confidentiality, integrity and availability of customer data. No system is completely secure. We improve our measures, address vulnerabilities and inform customers without undue delay about material incidents. Where applicable we follow the GDPR. For Customer Content we act as processor under our terms of service.

Our security approach

  • Defence in depth: technical and organisational measures for the application, data and infrastructure.
  • Least privilege: staff and services only receive the permissions needed for their task.
  • Separate environments for development and production.
  • Secure development with code review, dependency checks and security updates on a reasonable-effort basis.
  • Secrets in environment settings with restricted access.

Data protection

  • Transport: traffic to ITLedger is encrypted with TLS 1.2 or higher. HSTS is enabled where supported.
  • Storage: we use managed data services with encryption at rest where the platform supports it.
  • Access: granular roles in the product; staff access to production is restricted, logged and based on their role.
  • Authentication: strong passwords are supported; where available we recommend integration with SSO or an identity provider.
  • Backups and recovery: regular backups of critical data and periodic restore tests on a reasonable-effort basis.
  • Logging and monitoring: application and access logs support troubleshooting and security investigations.
  • Vulnerabilities: regular updates, scans and fixes, with priority for high risks.
  • Changes: controlled rollout with version control and the ability to roll back changes.

Data location and sub-processors

We aim to host primary services and data in the EU where possible. We use vetted providers for hosting, databases, email, payments and analytics, among other things. The current sub-processor list is available from our privacy contact. We announce material changes and offer an opportunity to object on reasonable grounds.

Richard uses Mistral AI for model processing. By default ITLedger requires the European Mistral endpoint. This concerns model processing and is no guarantee that all account, billing or other operational data at Mistral stays in the same region. The configured zero data retention applies to supported model requests; see the explanation and limitations in the privacy policy.

For transfers outside the EEA, the United Kingdom or Switzerland to countries without an adequacy decision, we use appropriate safeguards, such as the EU standard contractual clauses and additional technical and organisational measures where necessary.

Incidents and notification

We investigate suspected security incidents promptly. In the event of a data breach affecting Customer Content, we inform affected customers without undue delay, with the known details and recommended steps. Material incidents are evaluated and remediation measures are tracked.

Reporting vulnerabilities

Think you have found a vulnerability? Email security@itledger.eu or jorrit@brainforge.nl with steps to reproduce the issue. Give us a reasonable opportunity to fix it before you make the issue public. Avoid tests that reduce availability or affect other customers.

Customer responsibilities

  • Use strong, unique passwords and SSO where possible. Remove access for departed users promptly.
  • Apply role-based permissions and least privilege.
  • Align retention, exports and backups with your needs. Only upload sensitive data when necessary.
  • Keep the devices and networks your users access the Service from secure.

Compliance and commitments

When processing personal data in Customer Content, we are processor under our terms of service. For website, account and billing data we are also controller; see the privacy policy.

We currently do not claim formal security certifications. If we obtain them, we will publish them or a summary here. Within our small organisation we do our utmost to maintain appropriate measures, but we do not guarantee absolute security. A formal availability SLA only applies when agreed in writing.

Changes

We may update this page in response to improvements, provider changes or regulation. Each revision states a new date; material changes are announced where reasonable.

Contact