★ 4.8 / 5 Google Reviews · for organisations of 50–250 employees

I build what other advisers put in writing. And I run it myself.

A certificate does not discharge your duty of care, and the regulator is entitled to inspect your systems on site. What you get from me is not a report on what ought to happen — I put the measures in place, and the same stack runs on my own infrastructure.

Book a call → See what's running

What is standing when I am done

Four states, not four kinds of work. Each one comes with the evidence that I have set it up that way myself.

Who has access to what is fixed, and traceable

One place where access is granted and revoked: single sign-on, multi-factor authentication, an access matrix that matches reality, and logging that lets you see afterwards who did what.

Learn more →

Your recovery is tested, not assumed

Backup with offsite replication. On larger implementation engagements, that includes a restore that has actually been carried out — with the date, the elapsed time and the outcome on record. A backup that has never been restored is an assumption.

Learn more →

You can show that it works, not just that it is written down

A record that describes the working situation rather than the intended one: which measure runs where, who signs off on it, which supplier it depends on, and what you have required of that supplier.

Learn more →

Your board knows what is expected of it

The Dutch Cyber Security Act places responsibility explicitly with the board and obliges directors to keep themselves trained. I brief them in their own language, with the decisions they have to make as the subject.

Learn more (Dutch page) →

My own rack

my own hardware in a data centre, not rented space in someone else's cloud

Public

code, tests and a security analysis you can check yourself

4.8 / 5

from 51 Google reviews

★★★★★ 4.8 / 5 on Google

Judge me by my work

My clients work under confidentiality, so you won't find logos here. What you will find: platforms running in production, code you can read, and a security analysis that's publicly verifiable. Check it yourself and judge.

View the projects →

Technology & trust