Security and storage

Adopted: 29 October 2026.

F-Register operates its application, databases, website and business email itself on Dutch server infrastructure. Worldstream supplies hardware without management access to tenant content or a server-backup service for that arrangement. Customer documents, photos and encrypted offsite backups reside exclusively at TransIP Object Store, Amsterdam, Netherlands (AMS2). Each tenant has a separate database and storage project; backups use a separate project.

Access and support

Controls include HTTPS, session security, validation, roles, CSRF protection and limits on sensitive operations. Monitor administrators require MFA. Tenant MFA is voluntary per account and off by default. Temporary support requires one-time customer approval for View or View and modify and ends on expiry, revocation or termination of the operator’s monitor session. Emergency recovery is limited to a verified account, requires monitor MFA and password confirmation and records reason and actor.

Backups, termination and recovery

Encrypted offsite backups have14-day retention; local cPanel backups have at most five daily copies. Termination uses the agreed end date and a retrieval period of one calendar month and at least30 days. For switching, retrieval starts after the agreed transition. Controlled erasure follows, subject to narrow statutory exceptions. Valid deletion instructions are reapplied after restore.

Jurisdiction and unlawful foreign access

The described primary processing/storage occurs in the Netherlands under applicable Dutch/EU law. Access is restricted to authorised people bound by confidentiality. We assess foreign-authority requests for lawfulness and conflict with EU/Dutch law. A foreign request alone does not justify disclosure. Where legally permitted we inform customers and challenge unauthorised or disproportionate requests. Dutch storage does not guarantee that every customer-selected external integration processes exclusively inside the EEA. The privacy notice and DPA explain recipients and applicable transfer safeguards.

Assessment and contact

We maintain and review controls periodically. Technical release review has been performed; an independent external penetration test is the next additional security assessment. We do not claim certification or absolute security. Security/privacy reports: privacy@f-register.nl. Exports and switching: info@f-register.nl.