Open Standards and Internet Security
Which open standards from the Dutch "pas toe of leg uit" list LeraLink supports, which are planned, and which still need to be verified.
Last updated: 12 November 2026
Who this page is for
Dutch government organisations are expected to apply the open standards on the "pas toe of leg uit" (comply or explain) list of the Forum Standaardisatie when they procure or build ICT, or to explain why they do not. Some of these standards are also required by law for government websites: HTTPS and HSTS under the Wet digitale overheid, and digital accessibility under EN 301 549.
This page tells such buyers where LeraLink, operated by SSStudio, stands on each relevant standard. We mark a standard Supported only where we have checked it. Where a standard depends on configuration that we have not yet measured with an independent test, we mark it To be verified with internet.nl and will replace that mark with the result.
Status key
| Mark | Meaning |
|---|---|
| Supported | In place, and checked |
| Partly supported | In place for some parts, or not yet to the full standard |
| Planned | Not yet in place; we intend to implement it |
| Not offered | Not available, and not currently planned |
| To be verified with internet.nl | Probably in place through our hosting provider's configuration, but not yet confirmed by a test |
Which addresses are covered
| Address | Who manages the domain |
|---|---|
| lera.link (website and email) | SSStudio |
| hub.lera.link (LeraLink's own installation) | SSStudio |
| Installations on a LeraLink address | SSStudio |
| Installations on a customer's own domain | The customer manages the domain and its DNS; LeraLink serves the site |
For an installation on its own domain, standards that are set in DNS or in the customer's email (DNSSEC, IPv6 records, SPF, DKIM, DMARC and mail transport security) are the customer's responsibility. Standards set by the website itself (HTTPS, HSTS, security headers, security.txt) are LeraLink's.
Internet security standards
| Standard | Status | Notes |
|---|---|---|
| HTTPS | Supported | All pages and the programming interface are served over HTTPS. That plain-HTTP requests are redirected to HTTPS on every address is to be verified with internet.nl. |
| HSTS | Supported | Set on every HTTPS response, by the application and for static files by the hosting configuration, with a lifetime of one year, including subdomains. Not on the browser preload list. |
| TLS according to the NCSC guidelines | To be verified with internet.nl | Connections are terminated by Cloudflare with certificates it manages. The minimum TLS version and the cipher suites offered have not yet been checked against the NCSC's ICT security guidelines for TLS. |
| security.txt | Partly supported | Published at /.well-known/security.txt on every LeraLink address, including installation domains, with a contact address (security@lera.link), an expiry date one year ahead and preferred languages (English, Dutch). A link to the Coordinated Vulnerability Disclosure policy is included once its address is configured. There is no Canonical field, and the file is not signed. |
| DNSSEC | To be verified with internet.nl | For lera.link and its subdomains. DNS is hosted by Cloudflare, which supports DNSSEC. |
| IPv6 | To be verified with internet.nl | For the websites, the name servers and the mail servers of lera.link. |
| RPKI | To be verified with internet.nl | Route origin validation for the addresses that serve lera.link. |
| SPF | To be verified with internet.nl | For lera.link and the domains from which LeraLink sends email. |
| DKIM | To be verified with internet.nl | Email is sent through Resend, which signs with DKIM for verified sending domains. |
| DMARC | To be verified with internet.nl | A DMARC policy of "quarantine" or "reject" is the target. |
| STARTTLS and DANE (email) | To be verified with internet.nl | For mail received at and sent from lera.link. |
Other standards on the list
| Standard | Status | Notes |
|---|---|---|
| Digital accessibility (EN 301 549, WCAG 2.1 level AA) | To be assessed | We aim for WCAG 2.2 level AA, which includes the WCAG 2.1 AA criteria. No independent audit or full conformance assessment has been carried out, so we do not claim full or partial conformance. See the Accessibility Statement. |
| PDF/A | Not offered | LeraLink can produce PDF editions of works, but not as validated PDF/A files. Exports use the formats listed below. |
| ODF (OpenDocument) | Not offered | LeraLink does not produce ODF files. |
| SAML and OpenID Connect (single sign-on) | Not offered | Single sign-on for organisations is not available yet. People sign in with a one-time email code; administrators can use passkeys. |
| NEN-ISO/IEC 27001 and 27002 | Not offered | SSStudio holds no certification. See Security Documentation and Assurance for what we can provide instead. |
General data standards
These are not all on the "pas toe of leg uit" list, but buyers often ask about them.
| Standard | Status | Notes |
|---|---|---|
| UTF-8 | Supported | Pages, the programming interface, exports and security.txt use UTF-8. Content in any script, including right-to-left languages, is stored and exported without conversion. |
| ISO 8601 dates and times | Supported | Dates and times in exports and in the programming interface are written in ISO 8601 form (for example 2026-11-03T09:00:00.000Z). Pages show dates in the reader's language. |
| Language tags (BCP 47) | Supported | Content language is recorded per work and per passage, and marked in pages so that browsers and assistive technology can use it. |
Open formats and portability
We do not lock content into a proprietary format.
- Installation export. An installation's administrators can export the whole installation as one archive: structured data in JSON, works in Markdown and HTML, people in CSV, and every file in its original format, up to 2 GB of files per archive (files beyond that are named in the manifest). A manifest lists the contents with a checksum, and the archive includes RO-Crate metadata, an open standard for describing research data packages. The archive can be read and rebuilt without LeraLink.
- Personal data download. A person can download their own data as an archive with a JSON file and a README and, for one installation, the works that are theirs alone in Markdown and HTML.
- Files. Images, audio and documents are kept and exported in the format in which they were uploaded.
The Data Export and Exit Policy describes the export, and Data Act, NIS2 and Other EU Rules explains how it meets the switching rules of the Data Act.
How we will verify
internet.nl is the independent test of the Internet Standards Platform, which the Forum Standaardisatie uses to measure the internet security standards above. We will run its website test and email test on:
- lera.link (website and email);
- hub.lera.link (website);
- at least one installation on a LeraLink address and one on a customer's own domain (website).
Results will be published here after the next test. We will publish the scores and the test dates on this page, replace each "To be verified with internet.nl" mark with the result, and repeat the tests after any change to hosting, DNS or email delivery, and at least once a year.
| Address | Website test score | Email test score | Test date |
|---|---|---|---|
| lera.link | Not yet tested | Not yet tested | — |
| hub.lera.link | Not yet tested | — | — |
| An installation on a LeraLink address | Not yet tested | — | — |
| An installation on a customer's own domain | Not yet tested | — | — |
Any organisation can run the same tests on these addresses itself.
Contact
Questions about standards or test results: security@lera.link. Accessibility: accessibility@lera.link.
Sources
- Forum Standaardisatie, open standards list ("pas toe of leg uit"): forumstandaardisatie.nl
- Forum Standaardisatie, inventory of use of open standards (MOS 2025), listing the internet security and accessibility standards and their legal status: forumstandaardisatie.nl
- Forum Standaardisatie, security.txt on the "pas toe of leg uit" list since 25 May 2023: forumstandaardisatie.nl
- Internet.nl: internet.nl
- NCSC, ICT security guidelines for Transport Layer Security (TLS): ncsc.nl
- RFC 9116, A File Format to Aid in Security Vulnerability Disclosure (security.txt): rfc-editor.org
- RFC 6797, HTTP Strict Transport Security: rfc-editor.org
- EN 301 549 and WCAG 2.1: w3.org