Data security: a checklist for your software supplier

Why should you assess a software supplier on data security?

You should assess a software supplier because your firm remains responsible for your clients' personal data, even when a supplier processes it for you. Invoices, receipts and bank transactions contain names, addresses, IBANs and sometimes sensitive information about health or private spending. Under the GDPR (AVG in Dutch), the firm is the controller and the supplier is the processor.

According to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), both parties are required to have a data processing agreement, and if it is missing, both are in breach. As controller you remain responsible, even if the supplier drafted the agreement. A checklist helps you ask every supplier the same questions and keep the answers, so you can show what you checked when clients or a regulator ask.

What do you record in the data processing agreement?

In the data processing agreement you record which data the supplier processes, for what purpose, under which security measures and what happens at the end. The AP lists, among other things: processing only on your instructions, confidentiality, appropriate security, rules for sub-processors, help with breaches and privacy rights, deleting or returning data at the end and cooperation with audits.

Pay particular attention to sub-processors and data location. According to the AP, the supplier does not engage sub-processors without your prior written consent, or you agree in advance under which conditions it may. If data is transferred to a country outside the European Economic Area, that is only allowed to a country with an adequate level of protection or with appropriate safeguards, such as the European Commission's standard contractual clauses. So ask:

• Is there a data processing agreement (DPA), and who drafts it?
• Which sub-processors are used, for what, and how are you informed of changes?
• In which countries is the data stored and processed, and does it stay within the EU or EEA?
• Which safeguards apply to transfers outside the EEA?
• Is data deleted or returned at the end, including copies?
• Does the supplier cooperate with audits and provide the information needed?

Which technical security measures should you check?

Check how the data is technically protected: encryption, access control, logging, backups and the supplier's own access. Encryption should apply both in transit and at rest. Access should be configurable per role and per administration, so a team member only sees what they need and a client only sees their own company.

Also ask about signing in. Multi-factor authentication (MFA), where a second factor is needed alongside a password, makes a stolen password far less valuable. An audit log shows who did what and when, which is essential in an incident or when a client asks a question. Backups and recovery procedures determine how quickly you can work again after an outage. The questions at a glance:

• Is data encrypted in transit and at rest, and how is key management handled?
• Can roles and permissions be set per user and per administration?
• Is multi-factor authentication (MFA) or Single Sign-On available or required?
• Are actions by users, administrators and automated processes recorded in an audit log?
• How often are backups made and how is recovery after an outage arranged?
• Who at the supplier has access to production data, and how is that restricted?
• Which certifications does the supplier actually hold, and can you see the reports?

What should a supplier do in the event of a data breach?

In a data breach, the supplier must inform you as controller as quickly as possible, so you can report on time. According to the AP, the controller reports a breach to the AP within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to the people concerned. If there is likely to be a high risk, you must also inform those people directly. Always check the current rules on autoriteitpersoonsgegevens.nl.

You can authorise the supplier in writing to report breaches on your behalf, but you remain legally responsible for reporting on time. So record in the data processing agreement exactly within what period the supplier informs you, through which contact point and how you will be kept up to date. A shared mailbox for breach notifications prevents a report from sitting unread because one person is away.

1. 1Agree a fixed period within which the supplier reports a breach to you.
2. 2Record a reachable contact point for breaches, such as a shared mailbox.
3. 3Decide whether the supplier may report on your behalf and record that in writing.
4. 4Ask which information the supplier provides with a notification.
5. 5Assess within 72 hours of becoming aware whether you must report to the AP and the people concerned.

Which questions should you ask about AI and data deletion?

On AI, the key question is whether client data is used to train AI models, and if so, which models and for whom. There is a big difference between software that learns from corrections within your own environment and a supplier that uses client data to improve public or shared models. Also ask how you can see what the AI has done, and whether you can specify which actions always require a human.

On exit, ask what happens to the data when you cancel: is it deleted, can you export it first and how long do backups remain. Keep your own retention obligations in mind: bookings live in the accounting software, but you may want to keep source files and question history yourself before the supplier deletes them.

• Is client data used to train AI models, and if so, which ones?
• Is client data sold or shared with third parties?
• Is every automatic action explainable and traceable?
• Can you specify which amounts or actions may never be automated?
• Is data deleted on termination, and can you export it beforehand?

How does Autoboeker answer these questions?

On its security page, Autoboeker says it is built with modern encryption, strict access control and documented internal procedures, and that policies, sub-processors and documentation are available in the Trust Center at trust.autoboeker.nl. A DPA is available. Data is encrypted in transit with TLS and at rest with AES-256, with secure key management. Access is role-based and administration-specific, user activity is logged and every action by users and AI is traceable in audit logs. Autoboeker also lists daily backups, redundant infrastructure, monitoring, continuity and disaster recovery procedures, incident response procedures and restricted access to production.

On data and AI, Autoboeker says client data is never sold or shared, is only used to deliver the service, is deleted when the account is terminated and is not used to train public AI models. You set a confidence threshold, specify which amounts, ledger accounts or actions may never be automated, and every booking shows its confidence score, sources and the rule applied. Autoboeker is developed using security principles from ISO/IEC 27001, SOC 2 and the GDPR; that is not a certification, and the certification status is in the Trust Center. You'll find details on data location, MFA and the deadline for breach notifications in the Trust Center, or ask about them in a call, where the team walks you through the measures, the DPA and the sub-processors. Single Sign-On is available on request.