Trust and security

Where your documents are and who can access them.

This page sets out what DataSnap does today to protect your data, what is still in progress and how to report a vulnerability. A municipality's information security officer or a hospital's DPO will find the answers for their questionnaire here. We update the table as soon as anything changes.

Last updated: 5 October 2026

Status

What is done and what is still in progress.

We keep this list honest. Not every item is green yet, and we would rather say so ourselves. What you need to process your post, invoices and case files digitally today already works. What is still in progress is listed below, with its current status.

Topic	Status	Notes
Local processing	Available	Text recognition and AI run on your own PC or server. The desktop app works without the cloud.
Choosing what goes to the cloud	Available	For each step in the workflow, you decide whether a document may go to the cloud.
Signed updates	Available	Every update is digitally signed. The service checks the signature before it installs.
Two-step sign-in and passkeys	Available	In the portal. An administrator can make two-step sign-in mandatory for everyone.
Archive with object lock	Available	A document is never overwritten. During the retention period or a legal hold, nobody can delete it.
Hosting of the portal and archive	Available	At vshosting, in a data centre in the Czech Republic, inside the European Union.
External penetration test	Planned	An outside firm tests the portal and the archive. A summary of the results will then be available on request.
CyFun Basic	Started	We have started the CyFun Basic self-assessment. Verification by an accredited assessor follows.
ISO 27001	On the roadmap	No certificate yet. We will say so here as soon as a certification project starts.

GDPR

Who processes what

If you only use the desktop and the service, we process none of your documents. For the portal, the phone app and the archive we act as processor and sign a data processing agreement with you. Health data (Article 9 GDPR) can therefore stay entirely on the hospital's servers.

Model data processing agreement with an annex on technical and organisational measures (TOMs)
List of subprocessors, with advance notice of any change
DPIA template for your own assessment

AI Act

What the AI does

DataSnap uses AI to recognise document types and read fields. It never makes decisions about people.

For every value you see where it is on the page
Anything that is not in the document stays empty and is flagged
You can make review mandatory per field
We do not train models with your documents. A model of your own, based on your documents, is built only at your request and used only for you.

Subprocessors

Subprocessors and where they are based.

Service	Purpose	Location
vshosting (VSHosting s.r.o.)	Portal, cloud processing, archive	Czech Republic (EU)
Mailgun	Outgoing e-mail from the portal	European Union
Google Firebase Cloud Messaging	Push notifications to the phone app	To be confirmed
AI providers	Only if you switch one on yourself, with your own key or ours	As you choose

The full list of subprocessors with the contractual details is part of the data processing agreement.

Report a vulnerability

E-mail contact@dataswitch.io. We confirm that we have received your report and keep you informed until the issue is fixed. We report actively exploited vulnerabilities as the Cyber Resilience Act requires.

GET https://datasnap.dataswitch.io/.well-known/security.txt
Contact: mailto:contact@dataswitch.io
Policy: https://datasnap.dataswitch.io/en/trust#report
Preferred-Languages: nl, fr, en

Continuity

If we were no longer here tomorrow

Your archive is in PDF/A and XML. Your configuration sits in a backup you keep yourself.

Each release comes with an SBOM and a fixed support period, as the CRA requires.

Documents

For your procurement file.

Data processing agreementtemplate with an annex on technical and organisational measures
Being drafted
List of subprocessorswith their locations
Being drafted
NIS2 questionnairecompleted template
Being drafted
AI assessment art. 6(3)EU AI Act
Being drafted
Accessibility statementportal and phone app
Being drafted
Penetration test summaryafter the test
Later

Book a 30-minute demo Request a formal quote