Security Policy
Last updated: 24 July 2026
Keeping software and data safe matters to us at Avomu (KvK 76757579). This page explains the steps we take to protect our website, apps and cloud products, what you can do to help, and how to report a security problem the right way. Please read it together with our Privacy Policy, which explains what data we collect and why.
How we protect data
We build and run our services with security in mind from the start. The main things we do:
- Encrypted connections. Traffic to our website and cloud products travels over HTTPS/TLS, so the data moving between you and us is encrypted and hard for others to read.
- Least-privilege access. We limit who can reach data. People and systems only get the access they actually need to do their job, and nothing more.
- Updates and patches. We keep our software and systems up to date, and we apply security fixes so known problems don't stay open.
- Secure by design. We think about security while we build, not only after, and we try to follow good practices for safe code.
- Release integrity. Where we distribute downloadable software, we can provide a digital signature so you can check a file really comes from Avomu and hasn't been changed.
Your account security
Some of the work is on your side too. To keep your account safe:
- Use a strong, unique password that you don't use anywhere else.
- Keep your login details secret and don't share them.
- If you think someone has got into your account, tell us fast at [email protected] so we can help.
- You are responsible for what happens under your account, so treat your login like a house key.
Payment security
When you pay, a trusted, PCI-compliant payment provider handles the transaction. We do not store your full card numbers on our systems. That means your card details are managed by specialists who meet strict payment security standards.
Where data is stored
Where possible, we aim to keep data within the European Economic Area (EEA). If that ever needs to change, we handle it in line with our Privacy Policy.
Backups
We take reasonable backups so we can recover if something breaks. Even so, you should keep your own copies of anything important to you. Two copies are safer than one.
If something goes wrong (incidents)
If a security incident happens, we investigate it and act quickly to limit any harm. Where the law requires it - for example under the GDPR breach rules - we tell the people affected and the relevant authorities within the time the law sets.
Reporting a security problem (responsible disclosure)
Found a weakness? We'd rather hear about it than read about it. Please:
- Tell us privately first at [email protected] or [email protected], before you share it publicly.
- Give us reasonable time to look into it and fix it.
- Don't access other people's data or damage the service while you're testing.
We also publish a security contact at /.well-known/security.txt. We don't run a paid bug-bounty programme, but we're genuinely grateful for responsible reports and we do read them.
No system is perfect
We work hard to protect your data, but we have to be honest: no method of sending or storing data is 100% secure. We can't promise absolute security, only that we take real, ongoing steps to keep the risk as low as we reasonably can.
Which law applies
This Security Policy is governed by the law of the Netherlands, and any dispute is for the competent Dutch courts.