Our certifications, memberships and legal documents
Everything a procurement or supplier review usually asks for, in one place.
How our own security is assured
We test other organisations for a living, so it is reasonable to ask how we run our own shop. These are the standards we are held to.
ISO 27001
Certified. The international standard for information security management, covering how we run and govern our own security.
SOC 2In progress
In progress. We expect our SOC 2 Type II report in H1 2027.
GDPR
We process personal data under the General Data Protection Regulation. Our privacy policy sets out the legal bases, the retention periods and your rights.
Certificates are available on request, together with the control framework CREDS applies on top of the standard ISO 27001 and SOC 2 controls.
We are a member of
Erkend leerbedrijf
Recognised training company, accredited to take on and supervise students entering the profession.
Cyberveilig Nederland
Member of the Dutch cybersecurity industry association, which sets conduct standards for its members.
NOREA
The Dutch professional association of IT auditors. Our registered IT auditors (RE) work to its standards.
Where we are, and where your data is
CREDS has its office in Utrecht, in the Netherlands, and all of our infrastructure is located in Europe.
We also support EU sovereign projects, where keeping data and operations inside European jurisdiction is a requirement rather than a preference.
Vleutensevaart 100, 3532 AD Utrecht, the Netherlands.
Legal documents
The agreements and policies that govern working with us.
- On request
Verwerkingsovereenkomst
Our data processing agreement, for engagements where CREDS processes personal data on your behalf.
- Read
Privacy policy
How we collect, process, store and protect personal data, and what rights you have over it.
- On request
Algemene voorwaarden CREDS Services B.V.
General terms and conditions for our services engagements.
- On request
Algemene voorwaarden CREDS ART B.V.
General terms and conditions for the ART platform.
- On request
DORA addendum
Addendum covering the Digital Operational Resilience Act, for financial sector clients in scope.
Need something for your supplier review?
Tell us which documents or certificates your process requires and we will send them over, including the control framework we apply on top of ISO 27001 and SOC 2.
Reporting a vulnerability instead? See our responsible disclosure policy.