Security Statement

Reference: ISMS-KLT-02 · Version: 1.1 · Date: 5 November 2026

Cardan helps organisations make their digital services accessible. In doing so, our customers entrust us with information. We take the availability, integrity and confidentiality of that information seriously. This statement explains how we organise information security and how to report a vulnerability to us.

To learn how we handle personal data, please read our privacy statement.

How we organise information security

  • Cardan is implementing an information security management system (ISMS) in accordance with ISO/IEC 27001. We use ISO/IEC 27002 for the controls, and we take the European NIS2 Directive and the Dutch Cybersecurity Act (Cyberbeveiligingswet) into account. Cardan is already ISO 9001 certified.
  • The ISMS covers the development, management, provision and support of our proprietary web applications.
  • Management adopts the information security policy, provides the resources and reviews the ISMS periodically, so that we keep improving.
  • We select controls based on a risk assessment. All our applications must meet an established minimum security baseline, covering among other things accounts and multi-factor authentication, encryption, logging, backups, updates and monitoring.
  • Everyone who works for Cardan only has access to the information they need for their work and is bound by confidentiality agreements.
  • Agreements with customers on security and on reporting security incidents and data breaches are laid down in the data processing agreement.

Report a vulnerability

Have you found a vulnerability in one of our systems? Please report it to us, so we can fix it before anyone can abuse it. This is called Coordinated Vulnerability Disclosure (CVD).

What can you report?

You can report vulnerabilities in any system or domain managed by Cardan, including cardan.com and the domains of our applications. Examples are a vulnerability that lets you bypass a login or gain unintended access to confidential data.

Not every anomaly is a vulnerability. Please do not report:

  • an anomaly that has no impact on the availability, integrity or confidentiality of information;
  • available version information (for example an info.php file), unless it shows that the system uses software with known vulnerabilities;
  • missing HTTP security headers, unless this demonstrably leads to a security problem.

In doubt? Just report it.

How to report

  • Email your findings to security@cardan.com.
  • Report as soon as possible after discovery.
  • Write in Dutch or English.
  • In your report, describe:
    • the vulnerability, and which software it concerns if you know (if it is an already known vulnerability, please give its CVE number: the public registration number for that vulnerability);
    • the IP address or URL of the system;
    • how we can reproduce the problem: the steps you took and the elements involved, such as input fields;
    • what you think the impact could be.
  • Screenshots help us.
  • Leave an email address so we can ask you questions.

Do not include any evidence in your first email, just a description of what you found. If the information is sensitive, we will agree with you in our reply on a safe way to share it. Our applications also publish the contact details in machine-readable form at /.well-known/security.txt.

What we ask of you

  • Do not place malware or other software that could harm our systems.
  • Do no more than necessary to demonstrate the vulnerability. Do not download, copy, modify or delete data, and do not view data belonging to others. A screenshot of your own account is enough.
  • Do not repeatedly gain access, and do not share access or information with others.
  • Do not keep any confidential data you obtained. Delete it immediately after we have confirmed your report.
  • Do not use attack techniques that disrupt the operation of systems, such as (Distributed) Denial of Service attacks, spam or buffer overflows.
  • Do not use brute force, dictionary or social engineering attacks to bypass login mechanisms.
  • Only test systems managed by Cardan. The agreements in this statement do not apply to systems belonging to others, even if you come across them while investigating a vulnerability in our systems.
  • Do not disclose the vulnerability before we have fixed it or have agreed on a disclosure date together.

What you can expect from us

  • We confirm receipt of your report within one business day.
  • Within five business days we tell you how we assess your report and how we expect to handle it.
  • We keep you informed of the progress.
  • We aim to fix a vulnerability within 90 days, and serious vulnerabilities as soon as possible. Together we agree whether and when the vulnerability will be disclosed.
  • If you follow the rules in this statement, we will not file a police report or take legal action against you.
  • We treat your report confidentially and do not share your personal data with others without your consent, unless the law requires us to.
  • If you wish, we will name you as the discoverer in any communication about the vulnerability. Reporting under a pseudonym is also possible.
  • Cardan does not run a reward programme (bug bounty).
  • If we cannot reach agreement, you can also report the vulnerability to the Dutch National Cyber Security Centre (NCSC).

Changes to this statement

Cardan may update this security statement by publishing a new version on this website. For the most recent version of our policy, please visit our website.