Cyber security
Last updated 15 August 2026
We sell online and we run software online, so security is not a feature we bolt on. This notice sets out our regulatory position, the measures actually in place, what happens if something goes wrong, and how to reach us if you find a hole.
Where we stand under the Cyberbeveiligingswet
The Cyberbeveiligingswet, or Cbw, is the Dutch implementation of the European NIS2 Directive. It places duties of care and duties to report on organisations that are designated as essential or important entities in the sectors the law lists.
We have not been designated as an essential or important entity by any Dutch ministry or supervisory authority, and no sectoral supervisor has been assigned to us. We are a small company outside the listed sectors, so the Cbw's mandatory regime does not currently apply to us.
We nevertheless registered voluntarily with the Nationaal Cyber Security Centrum, the national CSIRT, in July 2026 under KvK 95458859. Voluntary registration means we receive the NCSC's threat intelligence and advisories, and that the NCSC has a route to reach us directly if something that affects us is discovered. Our registration confirmation is on file and we will show it to a counterparty who asks.
We hold ourselves to the Cbw duty-of-care measures in proportion to our size, and we would follow its reporting rhythm in an incident, even though we are not obliged to. We would rather build to the standard now than discover we need it later.
How the platform is built
Authentication
We do not store passwords, because we do not issue any. Sign-in runs through Google, so credentials never reach us and there is nothing of that kind to steal from us. Sessions use cookies that are HttpOnly, Secure and SameSite scoped, and the session token we store is a hash, never the raw value.
Payments
Card details go straight to Stripe, which is certified to PCI DSS Level 1. We never see, transmit or store a card number.
Transport and headers
Every page is served over TLS 1.2 or 1.3, with older and weaker protocols refused, and HSTS tells browsers never to try an insecure connection. Every response carries a strict Content Security Policy plus frame, referrer, permissions and content-type protections.
Edge
The whole platform sits behind Cloudflare's network, which gives us DDoS protection, a web application firewall, and automated bot and threat filtering.
Data
Our database runs in the European Union. We store no IP addresses at all, only a two-letter country code, and anonymous visitors are never written to our activity log. Retention is enforced in code rather than by policy alone, so records are deleted on schedule whether or not anyone remembers.
Supply chain
The site is plain HTML, CSS and vanilla JavaScript with no build step, no bundler and no package tree shipped to your browser. That is unusual, and it is deliberate: a dependency you never installed cannot be compromised. The only third-party code that runs on our pages is Google Analytics, which loads only after you consent, and Stripe on the pages where you pay.
Risk management
- Backups run automatically every eight hours and cover both the application and the database.
- Restores are tested rather than assumed.
- The backend has had a full security review, and changes to authentication, payments or data handling are reviewed again before they ship.
- Access to production systems is limited to the people who need it, with multi-factor authentication on the accounts that hold it.
- Third-party processors are tracked in a register, with the data protection agreements that go with them.
If something goes wrong
A personal data breach is assessed as soon as we become aware of it. Where the law requires it we notify the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, within 72 hours under Article 33 of the GDPR, and we tell the people affected without undue delay where Article 34 applies. We keep a breach register, and it exists whether or not there has ever been a breach to put in it.
A significant cyber incident would be handled on the Cbw rhythm: an early warning within 24 hours, a fuller notification within 72 hours, and a final report once we understand what happened. We would tell affected customers directly rather than leaving them to read about it.
Reporting a vulnerability
We welcome coordinated disclosure and we will not take legal action against anyone acting in good faith. Write to [email protected], or see our security.txt.
What we ask of you:
- Report privately and give us reasonable time to fix the issue before disclosing publicly.
- Do not access, change or delete data belonging to anyone else, and stop as soon as you have confirmed the issue exists.
- No denial of service, no spam, no social engineering of our staff or suppliers, and no physical attacks.
What you get from us: an acknowledgement of every report, an honest answer about whether we consider it a vulnerability, and credit where you want it. We do not run a paid bug bounty at present, so please report because you want the hole closed rather than for a fee.
What we ask of you
- Protect the Google account you sign in with, and turn on two-factor authentication.
- We will never ask for your password, and we will never ask for card details by email or message. Anyone who does is not us.
- If you receive something that claims to be from Brilliani and looks wrong, forward it to [email protected] rather than clicking it.
The plain-language version of much of this, aimed at customers rather than counterparties, is in the security and privacy FAQ. How we handle personal data specifically is in the privacy policy.