Security Registered Email
Security is essential for the Registered Email service and not only to obtain the legal value but increasingly to guarantee the privacy of messages and documents. The balance between the level of safety on the one hand and the user-friendliness on the other is an important consideration that we make every time. Possible risks are excluded and / or limited as much as possible, where a multitude of measures are taken and the service is closely monitored for its proper functioning. The service is regularly tested by independent parties, whether or not on behalf of our corporate clients.
- Aangetekend B.V. is since 2013 ISO27001 certified by Lloyds Register; ISO27001 is an international standard that deals with information security. The standard describes requirements for the design, implementation, monitoring, evaluation, tracking and improvement of a documented Information Security Management Systems (ISMS). This standard is tested externally every 9 months, which ensures that information security is maintained. Aangetekend B.V. also demands the same standard from its suppliers.
- Operational Risk Management, Security & Architecture (OSA) processes have been completed for and by various banks and insurance companies
- ‘ Ethical hackers ‘ test on a regular basis the safety of the service (PEN-testing) whether or not commissioned by our corporate clients
Data remain within Europe
- Also the data centres that Registered Email is using are ISO27001 certified and are on Dutch territory (thus also within the EEA)
- Data protection has been agreed in processing agreements in accordance with the GDPR
- After the Registered Email has been retrieved or may have been rejected by the recipient or the retrieval period has expired, the actual content will be deleted from your own Registered Email server; only the metadata surrounding the communication is saved
Secure connection between Sender, the own Registered Mail server from Sender and the Recipient
- For each organization/process, an own Registered Email server is set up with an SSL certificate allowing a secure connection (secure SMTP) to be rigged between other mail servers and web pages (https://)
- Registered Emails are stored in an encrypted environment until the mail is retrieved or declined or that the set retrieval period has expired
- Encryption-keys are stored separately from the customer specific environment
Retrieving a Registered Email by recipient
- Before the Registered Email server releases the mail, a CE-ID (32-bit) is requested; when 3 attempts fail the IP-address is blocked.
- A Hash code (SHA256) will be calculated for all submitted attachments to show – if desired – the authenticity of the message
Updates and management of the Registered Email Servers
- The further development takes place according to ‘security by design’ principle whereby the OWASP is consulted
- Updates are developed and delivered using a OTAP environment
- Management is conducted preventively by qualified screened personnel using monitoring system that monitors the correct operation of each registered mail server at 32 points.
- Secure passwords for SSH access using only known IP addresses for developers
- Anti-SPAM measures are continuously tightened using, among others, Reverse DNS, SPF, SSMTP, DKIM and DMARC
Additional Security measures have been taken around the Registered Email service which are classified as company confidential. More information about our security can be shared on request, after the signature of an NDA and on location office of Aangetekend B.V.