Kept safe. Without big words.

Your data

Your records are stored in Microsoft Azure datacentres in Ireland (Microsoft Azure North Europe). Everything travels over the internet encrypted (TLS 1.2 or newer) and is stored encrypted (AES-256).

Documents, mail drafts, notes on group sessions and the keys of your connections are encrypted once more by ombra itself, with AES-256-GCM. The key is kept separately, in a key vault. For the other data, such as session notes, notes on a whole series and your clients’ details, we rely on Azure’s encryption.

That is not end-to-end encryption: ombra must be able to read your data to show it to you. That is why ombra’s own access is kept as small as possible, as described below.

Every document you upload first goes through a malware scan. Only once the scan clears it can anyone open or download it.

Backups and recovery

• If one datacentre fails, a standby copy of the database in another datacentre takes over automatically, without any data being lost.
• We make continuous backups of the database. After an error we restore it to any moment in the past 35 days, and lose at most 15 minutes of changes.
• A copy of those backups is kept in the Netherlands (Microsoft Azure West Europe). If the whole of Northern Europe fails, we restore ombra from it. At most the last hour of changes may then be lost.
• Documents are spread over several datacentres in Ireland. We clean up an earlier or deleted version once it is older than 35 days; after that we can still recover it for 35 days.

After an outage we aim to have ombra working again within 4 hours. Every quarter we practise restoring a backup, and we check that everything comes back readable.

Who can reach it

• You. Your workspace is yours. The database itself shields each workspace from the others, independently of the app.
• Colleagues you invite. They see only what you share with them: a shared intake space or a group. Never your client records.
• Applicants and clients. They have no account in ombra. They fill in your forms, book an appointment and manage it with a personal link. They see nothing from your records.
• ombra itself. Only in exceptional cases, temporarily and recorded, as described under our own work.

You sign in with a password, a passkey, through Google or Microsoft, or with a one-time code by e-mail. On a new device ombra also asks for a code from your mail after your password, so a leaked password alone is not enough. A passkey stays on your device or in your password manager and works only with your face, fingerprint or PIN, and only on ombra: so it counts as two locks at once. If you set up an authenticator, ombra also asks for that code at every other sign-in. We strongly recommend it.

A sign-in session ends after 30 minutes without activity, and after at most 12 hours. With an authenticator, sensitive steps, such as setting up a new phone or closing your account, ask for a new code. In your settings you see where you are signed in.

The audit log

ombra records who opens, changes or exports a record, and when. Without names or content, only identifiers. So you see who opened which record.

Searching in ombra and the overview on Vandaag (Today) are recorded per workspace, not yet per record. If you see an extract from a note there, the log shows that you searched or opened Vandaag, not which record you saw. So the log is not yet a complete overview of all access.

The log is in your export. We keep a copy with identifiers only for 365 days separately, so that not even an administrator can change it unnoticed. If someone exports a complete account, we receive an alert.

No AI on your records

ombra does not record sessions and does not send your clients’ data to AI services. You write your notes yourself, and they stay with you.

If a feature with AI ever comes, it stays off until you switch it on. We say in advance which service it uses and which data that service receives, and notify you of that service as a new sub-processor, as article 7 of the data processing agreement says. AI models are never trained with your data or your clients’ data, not by us and not by a sub-processor.

The platform

• The database and document storage cannot be reached from the internet. Only ombra itself can reach them, within a shielded network.
• Outgoing traffic can go only to the Microsoft and Google services ombra needs.
• A web application firewall stops attacks before they reach ombra. Certificates for the secure connection are renewed automatically.
• Our log files contain no input, content or error messages that may contain client data. Only identifiers, codes and times.
• No analytics, no trackers and no third-party scripts in the app.

How we build ombra

• Development, testing and the real app are strictly separate environments. The development and test environments hold only invented data, never real client data. Programming tools too, AI included, never get to see real data.
• Every change is reviewed and only goes live once the automated tests pass. These include a security scan of the app (OWASP ZAP).
• We automatically check the components ombra runs on for known vulnerabilities. We apply a security update as quickly as possible.
• At least once a year we go through all these measures, and adjust them where needed.

Our own work

No one at ombra has ordinary, standing access to your data. An administrator only gets temporary access, with a second step at sign-in and a recorded reason: for an outage, a security incident or at your request. We record who, when and why. Only break-glass accounts, for when everything else fails, have lasting rights; we record that use too.

• Everyone who works for ombra has a written duty of confidentiality and receives instruction on privacy and security before getting that access.
• Every quarter we review who has which rights. If someone stops working for ombra, we revoke that access on the same working day.
• Work computers are encrypted, lock themselves and receive their updates. Administrator accounts always ask for a second step at sign-in.
• We do not print client data and keep no paper copies. There is no office with records: the servers are in Microsoft’s secured datacentres.

If something does go wrong with your clients’ data, you hear it from us without undue delay, as the data processing agreement says.

Certifications and tests

We would rather say it honestly than with a badge. ombra has no certificate of its own for ISO 27001, NEN 7510 or SOC 2. Microsoft Azure’s datacentres are certified, but that is their certificate, not ours. ombra is not connected to the eHealth platform either.

An independent penetration test has not yet been done. We will have one done before ombra becomes broadly available, and every year after that. We share the summary confidentially with practices that ask for it. If you need more for your own risk analysis, ask at privacy@ombracare.com. What could make misuse easier, we share only confidentially.

What you can do

• Set up an authenticator. Keep your recovery codes in a safe place, not on the same phone.
• Sign out on a computer you share with others.
• Sign-in codes from ombra always come from account@notify.ombracare.com. We never ask you to pass on a code, not by mail and not by phone.
• Lost the phone with your authenticator? Use a recovery code, or e-mail support@ombracare.com from your account’s e-mail address.
• Connect only a mailbox or calendar you are authorised to use yourself.
• Do not put client data in a mail to us.

Jurisdiction and authorities

ombra is established in the Netherlands. ombra’s infrastructure runs at Microsoft Azure in Ireland, with a copy of the database backups in the Netherlands, and is subject to the law of the European Union.

Microsoft is part of an American group. An American authority could therefore, in exceptional cases, ask Microsoft for data, for example under the CLOUD Act. This is how we keep that risk small:

• Microsoft keeps European customers’ data within the EU (the EU Data Boundary), with limited exceptions. In its data processing agreement Microsoft promises to challenge such requests and to inform the customer where that is allowed.
• ombra itself hands over data only on a valid order from a competent authority or court. If a request is too broad or unlawful, we challenge it. We let you know, unless the law forbids it.
• If a request concerns your clients’ records, we forward it to you. You are responsible for that data.

Reporting a vulnerability

Have you found a vulnerability in ombra? Let us know, and we will solve it together. E-mail security@ombracare.com with what you found, how we can verify it and what the consequences may be. English is fine too. Do not send passwords, codes or client data.

What we ask of you

• Use only your own test account. Do not look at other people’s data, and do not change or delete anything. If you do come across someone else’s data, stop and report it at once.
• No attacks that take ombra down, no spam through forms, no social engineering and no physical attacks. Do not test the services of Microsoft, Google and Cloudflare.
• Share the vulnerability with no one else until it has been fixed, and give us reasonable time for that.

What you can expect from us

• We confirm your report as quickly as we can, and keep you informed.
• If you follow these rules, we do not report you to the police and do not take you to court.
• If you wish, we name you when we announce the fix. We pay no reward.

These contact details are also in security.txt. Report an ordinary outage or a sign-in problem to support.

• Report a vulnerabilitysecurity@ombracare.com
• An outage or questionsupport@ombracare.com