ContactPortaal
Security & Privacy

Security and privacy by design, not as an afterthought

ContactPortaal processes citizen and farmer data, directly or indirectly. That carries responsibility. We built the platform from the first line of code on the principles of project separation, least trust and EU residency.

EUAVG / GDPRBIO

Data location

  • Personal data within the EU

    All persistent data (stakeholders, complaints, issues, documents) lives in Supabase PostgreSQL in Frankfurt (EU). No replication outside the EU.

  • Compute in EU regions

    The web application runs on Vercel Fluid Compute in EU regions. Requests are not routed outside the EU.

  • No US subprocessors in the default configuration

    No Cloudflare, no AWS US-East. Subprocessor list is public and changes are announced in advance.

Security measures

  • Row-Level Security

    Every database row is tied to a project. Users only see rows from projects they're a member of, enforced at the database level, not just in the application layer.

  • Two-factor authentication (TOTP)

    Optional 2FA per account with an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password). Recommended for admins; enforceable per project on request.

  • Encryption in transit and at rest

    TLS 1.2+ on all connections. AES-256 for data at rest. Passwords hashed with Argon2id. Backups encrypted.

  • Audit trail & soft delete

    Full audit trail on every change to CRM tables. Deleted rows remain recoverable within the retention window.

  • JWT with platform claims

    Tokens carry project_ids and roles, every request is verified at the database against those claims. No 'admin flag in a cookie'.

GDPR & DPA

  • Processor agreement (DPA) available on request, including the subprocessors we use (Supabase, Vercel, Resend, Esri).
  • Right of access, correction and erasure supported per stakeholder via an audit-safe endpoint. Erasures are recorded in the audit trail.
  • Retention windows configurable per document type and per CRM entity. Default 7 years for project documentation, shortened on request.
  • Data-breach procedure per GDPR: notification to you within 24 hours, to the supervisory authority within 72 hours.

BIO and NEN7510

The architecture is mapped against the BIO (Dutch government information-security baseline). The full BIO mapping and the complete overview of suppliers, SLAs and DPA clauses can be found on the Technical infrastructure page. NEN7510 is in scope for the on-premise variant within your own Azure tenant.

Two deployment options, identical architecture

ContactPortaal runs hosted by us within the EU, or inside your own Microsoft Azure tenant. Same codebase, same modules, only the hosting differs.

Cloud SaaS

Hosted by us in the EU

Live in days, not months. Supabase PostgreSQL in Frankfurt for the database, Vercel Fluid Compute in EU regions for the runtime, Resend for transactional email.

  • Live in days, not months
  • Automatic feature updates and security patches
  • EU residency by default, GDPR-compliant
On-Premise

Inside your own Azure tenant

Full control over data, backups and network. Microsoft Entra ID for single sign-on, Container Apps for the runtime, PostgreSQL Flexible Server for data, Blob Storage for files.

  • Within your own Azure subscription
  • Microsoft Entra ID integration for SSO
  • You own data, backups and infrastructure

Ready to take a look?

Book a 30-minute demo, we'll walk through your own scenario, not a generic tour.

Book a demoGet in touch