Security Documentation and Assurance
What security and privacy documentation an organisation can obtain from LeraLink, how to ask for it, and what assurance is and is not available today.
Last updated: 13 November 2026
Summary
SSStudio, trading as LeraLink, holds no security certification and has not yet had an independent penetration test. We provide instead: published descriptions of our measures, a contractual set of measures in the Data Processing Agreement, completed questionnaires, and audit rights under the Data Processing Agreement. A mapping to the Dutch government baseline (BIO2) is planned.
LeraLink is in a controlled pilot. SSStudio operates the service and answers documentation requests.
Published documents
These are public and can be read without asking:
| Document | What it gives you |
|---|---|
| Security Overview | How installations, accounts and content are protected, including what is not yet in place |
| Signing In and Account Security | Sign-in methods, passkeys and session limits |
| Technical and Organisational Measures | The measures we commit to as processor; an annex to the Data Processing Agreement |
| Data Processing Agreement | The processor terms under art. 28 GDPR |
| Subprocessors and Recipients | Every subprocessor and recipient, with role, location and safeguard |
| Where Your Data Is Stored | What is stored in the EU and what is not |
| Data Retention Schedule | How long each kind of data is kept |
| Backup and Recovery | Backup frequency, retention, restore tests and recovery objectives |
| Incident Response and Notification | How incidents are handled and when customers are told |
| Business Continuity | How the service continues if SSStudio or a supplier is unavailable, including the continuity partnership with DotNet Talk AB |
| Availability and Status | The status page and incident reporting |
| How LeraLink Uses AI and Responsible AI Commitments | The AI tasks, providers and safeguards |
| Coordinated Vulnerability Disclosure | How to report a vulnerability |
| GDPR at LeraLink, EU AI Act at LeraLink, Digital Services Act at LeraLink, Data Act, NIS2 and Other EU Rules | Our position under each law |
| Open Standards and Internet Security | Status of the Dutch "pas toe of leg uit" standards, and internet.nl results once the tests have been run |
| Accessibility Statement | Accessibility status and known limitations |
Available on request
| Item | Status | Conditions |
|---|---|---|
| Signed Data Processing Agreement with its annexes (Technical and Organisational Measures, list of subprocessors) | Available | For customers and prospective customers |
| Completed security questionnaire | Available | We accept standard questionnaires and an organisation's own; see below |
| Mapping of our measures to the Baseline Informatiebeveiliging Overheid (BIO2) | Not yet available; planned | For Dutch government customers and prospective customers; may be shared under a non-disclosure agreement |
| "Models used by this installation" | Available | A printable list of the AI models that would serve a given installation, with provider country, hosting region, training and retention facts where they have been recorded |
| Information for an algorithm register or impact assessment | Available | A description of each AI task, its human decision point, data sent and safeguards; see EU AI Act at LeraLink |
| Information on international transfers | Available | Insofar as it can be disclosed, a summary of the transfer safeguards and assessments |
| Summary of restore tests | Available | Dates and measured restore times |
| Penetration test summary | Not yet available | See below |
| Certification or audit report of SSStudio (ISO 27001, SOC 2 or similar) | Not available | No certification is held |
Some items describe our internal configuration in more detail than our public pages. We may ask for a non-disclosure agreement before sharing them, and we never share information that would weaken the security of other customers.
Security questionnaires
We complete security and privacy questionnaires for customers and prospective customers. We accept:
- an organisation's own questionnaire;
- commonly used standard questionnaires, such as the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ);
- questionnaires based on BIO2 or on NEN-ISO/IEC 27001 and 27002.
Our answers describe the service as it runs on the day we answer. Where a control is not in place, we say so rather than leave it blank. Answers refer to the published documents above where possible, so that they stay consistent.
Mapping to BIO2
Dutch government organisations must apply BIO2 under the Cyberbeveiligingswet, and often ask suppliers how their measures relate to it. BIO2 is based on NEN-ISO/IEC 27001 and 27002. We plan to prepare a mapping of LeraLink's measures to the BIO2 controls that are relevant to a software service, with for each control: whether it is met, partly met or not met, and the evidence. We will give a date here once the work has started.
Penetration testing
An independent penetration test of LeraLink has not yet been carried out. It is planned for the second quarter of 2027. When it has been done, we will:
- fix findings according to their severity, and retest;
- publish on this page the date of the test and the name of the tester, if the tester agrees;
- share a summary of the findings and their remediation with customers and prospective customers under a non-disclosure agreement.
Until then, our assurance rests on automated checks run on every change (behaviour tests, a check of every protected action against the authorisation rules, and a check that public files expose no internal information), staged releases with the owner's approval, and reports received through our Coordinated Vulnerability Disclosure policy. These are not a substitute for an independent test.
Certification
SSStudio holds no certification. Certification to NEN-ISO/IEC 27001 is an aim. We have not set a date and will not claim one until we have.
Cloudflare, on which LeraLink runs, holds its own certifications and audit reports. They cover Cloudflare's infrastructure, not LeraLink's application or SSStudio's operations. Where Cloudflare makes them available to its customers, we can pass them on under Cloudflare's conditions; some can only be obtained from Cloudflare directly.
Audit rights
Customers that have concluded the Data Processing Agreement may verify our compliance with it, as art. 28(3)(h) GDPR provides. The Data Processing Agreement sets the conditions: in summary, we first provide the documentation and information needed to demonstrate compliance; where that is not sufficient, or a supervisory authority requires it, the customer may have an audit carried out by an independent auditor who is bound by confidentiality and is not a competitor of SSStudio, at most once per calendar year unless a breach or an authority's request gives reason for another, with at least 30 days' written notice to privacy@lera.link, and without access to other customers' data. The customer bears the costs of the audit, unless it shows a material breach by us. Supervisory authorities may audit us under their own powers.
Non-disclosure agreements
Where an item requires a non-disclosure agreement:
- Ask at legal@lera.link and say which items you need.
- We send a mutual non-disclosure agreement under Dutch law, or review yours.
- Once it is signed by both parties, we share the items through a channel agreed with you.
How to ask, and how quickly we answer
| Request | Address |
|---|---|
| Security documentation, questionnaires, BIO2 mapping, penetration test summary | security@lera.link |
| Data Processing Agreement, non-disclosure agreements, legal questions | legal@lera.link |
| Audit requests, privacy and transfer information | privacy@lera.link |
We confirm receipt of each request and tell you when you can expect an answer, which depends on the item and, for a questionnaire, on its length. We will tell you if a request will take longer than that, and why. Requests are handled in English or Dutch.
Changes
We update this page when an item becomes available, when a test or certification is completed, or when a document changes. Material changes to the Data Processing Agreement, the Technical and Organisational Measures and the list of subprocessors are announced under the Change Notification Policy.
Sources
- Regulation (EU) 2016/679 (GDPR), art. 28: eur-lex.europa.eu
- Baseline Informatiebeveiliging Overheid (BIO2), Digital Government: nldigitalgovernment.nl
- Cyberbeveiligingswet (NCSC): ncsc.nl
- Cloud Security Alliance, Consensus Assessments Initiative Questionnaire: cloudsecurityalliance.org