Security programme // NIS2[+]
Our security programme, measure by measure
In place 1
In progress 10
Planned 1
Reviewed // 09.10.2026
-
21.2 a
In progress
Risk analysis and security policy
Information security risks are assessed and treated in a risk register, and policies follow a versioned approval flow.
NextSecurity policy being approved by management.
-
21.2 b
In place
Incident handling
Incidents are registered with severity, owner, containment, recovery and evidence, through a fixed lifecycle from open to closed.
NextAlerts to each affected customer, with an alert log, being added.
-
21.2 c
In progress
Business continuity
Leasify App runs on managed infrastructure in the EU with backups, and continuity activities are scheduled in our compliance calendar.
NextRecovery objectives and documented restore tests being introduced.
-
21.2 d
In progress
Supply chain security
Suppliers are kept in a register with criticality, data processing agreements and periodic reviews.
NextSecurity review of every subprocessor and a complete public subprocessor list under way.
-
21.2 e
In progress
Secure development and vulnerability handling
Every change is code reviewed and covered by automated tests before release, and releases are published in our changelog.
NextVulnerability register and in-house penetration tests being introduced.
-
21.2 f
In progress
Assessing effectiveness
Internal audits record findings and corrective actions against our controls.
NextControls being mapped to each NIS2 requirement.
-
21.2 g
Planned
Cyber hygiene and training
Security training for staff and management, with records per person.
NextTraining register per person, with renewal dates, to be introduced.
-
21.2 h
In progress
Cryptography and encryption
Traffic is encrypted with TLS, data at rest is encrypted by our cloud provider, and secrets are protected with AWS KMS envelope encryption.
NextCryptography policy being documented.
-
21.2 i
In progress
Access control and asset management
Role-based access in our applications, with access reviews and an asset inventory.
NextAsset inventory and recurring access reviews being introduced.
-
21.2 j
In progress
Multi-factor authentication
Strong sign-in for Leasify App users, with passkey and security-key requirements per customer.
NextPer-customer passkey and YubiKey requirements being rolled out.
-
Art. 20
In progress
Management accountability
Management approves the security measures, follows up on them and takes part in training.
NextManagement approval of each measure and management training being documented.
-
Art. 23
In progress
Incident reporting
For significant incidents we track the NIS2 reporting timeline: early warning within 24 hours, notification within 72 hours and a final report within a month.
NextReport content, export and alerts to affected customers being built.
Hosting
Laravel Cloud on AWS, Frankfurt (eu-central-1). AI features run on Azure OpenAI in the EU.
Supply chain
Our public subprocessor list is being compiled. Ask for the current list at [email protected].
Questions and reports
Security questionnaires, vulnerability reports and incident questions: [email protected]