Security Policy

Last updated: June 6, 2024

Haagse Kennis is committed to protecting the security of its platform, services, and the data entrusted to us by our users. This Security Policy describes the technical and organizational measures we implement to safeguard information processed through our services available at haagsekennis.com.

1. Scope

This policy applies to all systems, infrastructure, applications, and processes operated by Haagse Kennis in connection with the delivery of its AI chatbot design and development services. It covers data at rest, data in transit, and all internal operational procedures that affect the confidentiality, integrity, and availability of user information.

2. Infrastructure Security

2.1 Hosting and Environment

Our services are hosted on enterprise-grade cloud infrastructure maintained by reputable third-party providers. Physical access to underlying hardware is controlled and monitored by those providers in accordance with industry-standard security certifications. We do not operate our own physical data centers.

2.2 Network Security

All network traffic between users and our platform is encrypted using Transport Layer Security (TLS 1.2 or higher). Firewalls, intrusion detection systems, and network segmentation are applied to restrict unauthorized access to internal systems. Open ports and services are regularly audited and minimized.

2.3 System Hardening

Operating systems and server software are configured following security hardening guidelines. Default credentials are never used. Unnecessary services, ports, and software packages are disabled or removed. System configurations are reviewed periodically to ensure alignment with current security standards.

3. Data Security

3.1 Encryption at Rest

Sensitive data stored within our systems is encrypted at rest using strong encryption algorithms. Encryption keys are managed through dedicated key management practices and are rotated on a defined schedule.

3.2 Encryption in Transit

All data transmitted between clients and our platform, as well as between internal services, is protected using TLS encryption. Unencrypted communication channels are not permitted for any data classified as sensitive.

3.3 Data Minimization

We collect and retain only the data necessary to deliver our services. Data that is no longer required is securely deleted or anonymized in accordance with our data retention practices.

4. Access Control

4.1 Principle of Least Privilege

Access to systems, databases, and sensitive information is granted on a need-to-know basis. Employees and contractors receive only the minimum level of access required to perform their responsibilities. Access rights are reviewed regularly and revoked promptly when no longer necessary.

4.2 Authentication

All internal systems require strong authentication. Multi-factor authentication (MFA) is enforced for access to critical infrastructure, administrative panels, and cloud management consoles. Password policies require minimum length, complexity, and periodic rotation.

4.3 User Account Security

User accounts on the platform are protected by secure authentication mechanisms. We encourage users to enable any available multi-factor authentication options and to use strong, unique passwords. Accounts showing signs of unauthorized access are subject to automatic protective measures including temporary suspension.

5. Vulnerability Management

5.1 Patch Management

Security patches for operating systems, dependencies, and third-party libraries are applied in a timely manner. Critical patches are prioritized and deployed as quickly as operationally feasible. Patch status is tracked and reviewed as part of our ongoing security operations.

5.2 Security Testing

We conduct regular internal security assessments including code reviews and configuration audits. Periodic third-party penetration testing is performed to identify vulnerabilities that may not be detected through automated means. Findings are triaged and remediated according to their severity level.

5.3 Dependency Scanning

Third-party libraries and software components used within our platform are monitored for known vulnerabilities using automated scanning tools. Vulnerable dependencies are updated or replaced promptly upon identification.

6. Incident Response

6.1 Detection and Response

We maintain monitoring and alerting systems designed to detect anomalous activity, unauthorized access attempts, and potential security incidents. Alerts are reviewed by responsible personnel and escalated according to a defined incident response procedure.

6.2 Containment and Recovery

Upon confirmation of a security incident, we take immediate steps to contain the impact, preserve evidence, and restore affected systems to a secure state. Recovery procedures are tested periodically to ensure effectiveness.

6.3 Notification

In the event of a security incident that affects user data, we will notify affected users and relevant parties in accordance with applicable obligations and without undue delay. Notifications will include a description of the incident, the data affected, and the steps being taken in response.

7. Third-Party Security

We assess the security practices of third-party vendors and service providers who process data on our behalf. Vendors handling sensitive data are required to maintain adequate security controls consistent with industry standards. Vendor relationships are reviewed periodically and data processing agreements are maintained where applicable.

8. Physical Security

Our administrative operations are conducted from secured premises. Access to offices and workspaces where sensitive information may be handled is restricted to authorized personnel. Devices used to access platform systems are protected by full-disk encryption and screen-lock policies.

9. Employee Security

All personnel with access to platform systems or user data receive security awareness training upon onboarding and on a recurring basis. Employees are required to adhere to internal security policies and acceptable use guidelines. Background screening is applied in accordance with applicable local requirements and role sensitivity.

10. Backup and Business Continuity

Critical data and system configurations are backed up on a regular schedule. Backups are encrypted and stored in geographically separate locations where feasible. Restoration procedures are tested periodically to verify integrity and recoverability. Business continuity plans are maintained to minimize service disruption in the event of a significant incident.

11. Logging and Monitoring

System and application logs are collected and retained for a defined period to support security investigations and operational troubleshooting. Logs are protected against unauthorized modification. Access to log data is restricted to authorized personnel with a legitimate operational need.

12. Responsible Disclosure

We welcome responsible disclosure of security vulnerabilities discovered in our platform. If you believe you have identified a security issue, please contact us promptly at contact@haagsekennis.com. We request that you provide sufficient detail to reproduce and assess the issue and that you refrain from exploiting the vulnerability or disclosing it publicly until we have had a reasonable opportunity to investigate and remediate. We are committed to acknowledging reports promptly and keeping reporters informed of our progress.

13. Changes to This Policy

We may update this Security Policy from time to time to reflect changes in our practices, technology, or applicable requirements. The date at the top of this page indicates when the policy was last revised. Continued use of our services following any update constitutes acceptance of the revised policy. We encourage users to review this page periodically.

14. Contact

If you have questions or concerns regarding this Security Policy or our security practices, please contact us: