Security Policy

Access to client projects and internal systems is role-based and limited to what each person needs. Where a platform supports it, we use strong authentication.

Project files are stored in encrypted cloud storage and on studio devices with full-disk encryption. Backups are taken regularly and retained for a limited period consistent with each agreement.

AI-assisted tools are used under their provider's security settings. Client data is not fed into public AI models without your consent, and automated workflows are reviewed before anything goes live.

Deliverables are shared via secure, expiring links where possible. Client material is removed from shared locations when a project closes.

In the event of a security incident affecting personal data, we notify affected clients and, where required by the AVG, the Autoriteit Persoonsgegevens within 72 hours.

Report a concern: hello@dutchcroissant.com.