Security & compliance
Most supplier security pages are a row of logos. This one is a status list, because you are going to check it and because our own management system prohibits claiming a certificate we do not hold.
Upward Technologies is building an integrated management system to ISO/IEC 27001:2022 and ISO 9001:2015, intended for certification by a body accredited by the Raad voor Accreditatie. That work is in progress and no certificate is held today. The GDPR and the Uitvoeringswet AVG are not aspirations but obligations that apply now, and the Cyberbeveiligingswet (NIS2) sits alongside them as a direct legal duty with no certificate attached. Where a client requires independent assurance, the intended instrument is an ISAE 3000 or ISAE 3402 report; a SOC 2 report is commissioned only where a US or US-owned client requires one.
Information security management system covering managed hosting and the development activities that touch it. Scope, risk methodology, Statement of Applicability and policy set are drafted; certification audit not yet held.
Quality management system covering design, development, delivery and ongoing support. Operated as one system with the ISMS rather than a parallel set of documents.
We act as a processor for many unrelated controllers, and as controller for our own employee, supplier and prospect data. Article 28 agreements, a record of processing, a sub-processor register and a breach procedure that notifies you without undue delay under Article 33(2).
A managed service and hosting provider of our kind is likely in scope as an important entity. Confirmation of our classification and competent authority is with counsel, and the position is carried as an open item rather than presented as settled.
The intended independent assurance instrument for Dutch and European clients, covering security, availability, confidentiality and privacy. Commissioned once the control set has a measurement history worth reporting.
For healthcare workloads, including the patient data access logging that Dutch healthcare clients and their auditors will ask about.
Where AI features form part of what we build or run, role determination (provider or deployer) and an AI system impact assessment are part of the process rather than a later retrofit.
Security & compliance
We are a processor of other people's personal data, at scale, across many unrelated controllers. Every hosted site may hold personal data belonging to that client's own customers. We treat Article 28 contracts, sub-processor disclosure and breach notification as core operating processes, not legal housekeeping.
Yes, and we will read it. Where a clause commits us to something we cannot evidence, we will say so and propose the version we can actually meet, which is more useful to you than a signature that is untrue.
Yes. Hosting providers, mail, monitoring and any subcontracted support are disclosed, and material changes are notified so you retain your right to object.
Personal data and production data of you or your customers are not sent to third-party AI services. Where such data is processed by AI, this is done exclusively with models we host locally or ourselves, unless we agree otherwise in writing. Other confidential information, including source code, may only be processed through AI services procured on business terms that provide that your input is not used to train models, that the provider is bound by confidentiality and that a limited retention period applies. Free and consumer versions are not used for it. Without your prior written consent we do not use your data to train or improve our own or anyone else's models. We keep a record of the third-party AI services we use for you, and you can have that overview on request. This is set out in article 10 of our general terms and conditions, which apply to every agreement.
You are notified without undue delay with the content Article 33 requires, so your own 72-hour clock to your supervisory authority is not spent waiting for us. Under NIS2 our own reporting timetable runs separately, and both are exercised, not theoretical.
That is the right question, and it is the one auditors sample. Contractors and subcontractors sit inside the management system on the same terms as employees: same access controls, same evidence, retrievable the same way.
That is usually the most useful first conversation. Whether the answer is a new system, an AI agent, an integration between what you already have, or nothing at all, you get an honest assessment.
