Certifications are not a destination. They are proof of what we do every day: keep processes sharp, manage risks actively and protect customer and partner data as it should be. Our certifications are the result of continuous effort, not a badge on the wall, but a standard we earn again every year.
Get in touch
Internationally recognised standard for information security management. Proves that security risks are structurally controlled within a demonstrable management system. Renewed in May 2024.
Dutch standard for information security in healthcare, on top of ISO 27001. Also relevant when only administration and invoicing are handled for healthcare organisations (no EHR, no care process). eConnect does not process patient or care information; a number of healthcare-specific measures are excluded. Renewed in May 2024, valid until 20 February 2027.
Independent assessment of how internal controls operate over a measurement period. Not only designed, but also demonstrably effective in practice. Obtained in July 2024.
eConnect demonstrably works to recognised standards for information security and control of service organisations. All certifications are renewed annually by independent auditors.
Independent auditors assess our certifications annually. Periodic independent penetration tests keep the security profile current, and internal controls provide demonstrable evidence for customers with strict governance requirements.
Request documentation
Certified as an Access Point Provider by the Dutch Peppol Authority. eConnect operates multiple redundant Access Points with automatic load balancing for maximum availability and reliability.
One of the very few OASIS SMP-compliant solutions worldwide, listed on the official European Commission list of eDelivery SMP conformant solutions. Own implementation with no dependency on third parties, with built-in caching for 99,99% availability.
Certified for the DICO standard, specifically for the construction sector. Support for the G-account, reverse-charge VAT and chain liability.
Beyond information security, we are explicitly certified for the standards that matter every day in our field: Peppol transport, OASIS SMP and sector-specific exchange.
All processing takes place within the EU/EEA with encryption in transit and at rest. The cloud connection per service is documented so the data location stays transparent.
Co-founder of SimplerInvoicing, the Dutch e-invoicing network that has since grown into the Dutch Peppol Authority (NPa).
Actively involved in international standards development as a member of the OpenPeppol board.
Active member of the e-invoicing standardisation committee of NEN, the Dutch standards institute.
eConnect is not only a user of Peppol standards, but a co-developer. Our involvement in standards development means changes in the chain are visible and tested early.
Certifications matter because they objectively show that a provider has structured security and control. With e-invoicing you process financial and organisational data that falls under internal control frameworks and often under sector-specific requirements, so trust alone is not enough. Standards such as ISO 27001, NEN 7510 and ISAE 3402 provide assurance, because an independent party verifies that processes, measures and responsibilities are demonstrably in order.
With certified processing it is also easier to explain to your accountant, regulator and internal compliance why you chose a particular chain partner. eConnect combines these certifications with annual independent assessment, so the status stays current instead of frozen at one moment. Read more about our background in Our story.
eConnect protects data with a combination of technical security, process control and independent assessment. All processing takes place within the EU/EEA on cloud infrastructure in the Netherlands, Ireland and Western Europe, with encrypted communication and encrypted storage as standard. This limits risks around transport, storage and unauthorised access in the processing chain.
Annual penetration tests help identify vulnerabilities early and resolve them in a controlled way. The ISAE 3402 Type II certification confirms that controls also work in practice over an extended measurement period.
The difference is the breadth of the security profile and the combination of certifications that are active at the same time. ISO 27001, NEN 7510 and ISAE 3402 Type II complement each other in management system, sector-specific information security and demonstrable operational control. This makes eConnect suitable for environments where IT security, audit and governance all weigh heavily in vendor selection.
Add involvement in the Peppol ecosystem as co-founder of SimplerInvoicing (which has since grown into the Dutch Peppol Authority) and as an active participant in OpenPeppol working groups, so developments around standards become visible early. Annual penetration tests and periodic audits then keep security a continuous process.
Yes, eConnect is suitable for healthcare organisations thanks to the combination of NEN 7510, ISO 27001 and ISAE 3402 Type II. NEN 7510 is specifically relevant for information security in healthcare and matches the requirements healthcare organisations typically set in vendor selection, also when eConnect only processes the administrative and invoicing process (no EHR, no care process). eConnect does not process patient or care information; a number of healthcare-specific standard elements are excluded. Two-factor authentication is offered in case care information travels with the invoicing flow.
Beyond certification, the processing environment also matters, with data processing within the EU/EEA and encryption in transit and at rest. For sector-specific alignment, get in touch via Contact.
Yes, you can request security documentation, with a distinction between management information and full detailed reports. Through the Compliance & Security Reports subscription (under NDA) you periodically receive the pentest management summary plus the full ISAE 3402 Type 2 report including findings. The ISAE 3402 report is not shared free of charge on its own, except after approval by the board; through the subscription the full report is a standard part. The Statement of Applicability (SoA) is a different document from the full ISO report. The SoA shows where specific exceptions to the certificate apply and may be provided free of charge to a customer or prospect. The full ISO report is not a standard part of the module. It is available only in exceptional cases, solely after approval by the board, unpaid, and the NDA still applies.
For enterprise situations the full pentest report can become part of contractual agreements. Certificates for ISO 27001 and NEN 7510 are also publicly available through the audit organisation. Discuss the reporting format you need via Contact.
Get in touch