// Security

Security statement

This statement describes how Tulipsoft protects the software we build and the data of our clients. At the bottom you will find how to report a vulnerability.

How we secure software

We develop according to the OWASP guidelines. Every release is tested automatically for known vulnerabilities such as injection, broken access control, insecure configuration and outdated components with known weaknesses. Passwords and keys are never stored in the code. Every change is reviewed before it goes live, by a colleague or with the help of AI. Complex changes and sensitive parts, such as login and payments, are always reviewed by a colleague.

Encryption

Data is encrypted in transit, including between systems, and encrypted at rest. Keys are managed separately from the data they protect.

Access and environments

Employees only get access to what they need for their work. How strictly we separate development, test and production environments depends on the data. For sensitive data, such as personal data or payments, we use separate environments and record who has access to production.

Privacy by design

We process no more personal data than necessary and choose secure defaults. How we handle personal data is described in our privacy statement.

Hosting and data

We prefer hosting within the European Union. For every project we agree where data is stored, how backups are made and how recovery after an incident works.

Specialists and penetration tests

We take care of the basics ourselves. For optimal assurance we work with security professionals who do nothing but hacking every day, usually a red team. They attack an application the way a real attacker would. Findings are delivered in a report with priorities, and we fix what we built ourselves. Read more about our approach on the security page.

Legislation

We process personal data in accordance with the GDPR. We are preparing for NIS2 and are registered with the NIS2 Quality Mark.

Reporting a vulnerability

This applies to tulipsoft.nl and the systems Tulipsoft manages itself. If you find something in software hosted by a client, we bring the report to that client and coordinate together.

Found a weakness? Email [email protected]. Anonymous reports are welcome. Describe what you found, how we can reproduce it and what risk you see. This address is also listed in our security.txt file.

We ask you to:

  • go no further than necessary to demonstrate the vulnerability;
  • not copy, modify or delete any data;
  • not use social engineering, spam or overloading of systems;
  • not disclose the report before the issue is resolved and we have agreed on disclosure together.

What you can expect from us:

  • an acknowledgement within five working days, including a first assessment of the report;
  • we keep you informed about progress and about the moment the issue is resolved;
  • we resolve software vulnerabilities within 60 days, or we explain why a different timeline or an accepted risk applies;
  • after the fix we agree with you whether and how we publish about it.

We do not take legal action against reporters who follow these rules. We are not yet large enough to offer a monetary reward, but we are happy to contribute to the recognition you deserve, for example by naming you in the publication about the fix.

Can this statement change?

Yes. When it changes, we update this page. Last updated: 4 September 2026.