Certified where it counts
ISO 27001:2022, certified by an accredited body. The certificate and its full scope are published below.
The Masterminds Trust Centre
Everything you need to assess us, in one place
One question brings you here: can we be trusted with your platform and your data. This page separates what an auditor has verified from what is our own practice, and says plainly where we hold nothing.
European by design
A European company working with European organisations. Residency, access governance and provable control are how we build.
Straight answers
Questionnaire, DPA, sub-processor list or audit evidence: a named contact and a real date, not a portal.
Certificates
Independently issued, independently verifiable
Check each one with the issuing body. None rest on our word alone. These three are all we hold: no SOC 2, ISO 9001 or NEN 7510, and we will not imply otherwise in a tender.
ISO 27001:2022
View certificateCertified scopeThe provision of consulting, design, implementation, and managed services for data, DevOps, and analytics platforms, including automation, cloud infrastructure, and database solutions.
Microsoft Solutions Partner
View confirmation letterWhy it mattersAssessed capability on the platform we deploy your workloads to, plus a direct escalation route into Microsoft support.
Redgate Gold Partner
Verify on Redgate's directory Read Redgate's case studyWhy it mattersDatabase change is where most delivery risk concentrates. Gold reflects assessed depth in the tooling that controls it.
Security
How we protect your environment and our own
These controls sit inside our Information Security Management System, which an external auditor assesses.
Working inside your environment
- Least privilege, time bound. Access is requested for a named purpose and removed when the engagement ends.
- Read-only by default. Scope and access are agreed before anything connects.
- NDA first. A non-disclosure agreement can be in place before environment access is even discussed.
- Named, screened consultants. You know who is in your tenant, working under both our policies and yours.
- Your data stays in your tenant. We do not copy production data into our own systems in order to do our work.
- Clean exit. Access revocation and return or deletion of material is part of how an engagement closes.
Our own estate
- Multi-factor authentication and conditional access on all company accounts.
- Managed, encrypted endpoints with centrally enforced policy.
- Encryption in transit and at rest for company data.
- Documented incident response, with customer notification within agreed timeframes.
- Risk assessment, internal audit and management review on the ISO 27001 cycle.
- Security awareness training for every employee, repeated annually.
Compliance
The European rules that shape our work
These land on our customers, and through the supply chain on us. Our actual position on each.
GDPR
Controller for our own business contacts, processor when we handle personal data for you. An Article 28 DPA, sub-processor list and transfer position are available on request. See the Privacy Policy, or contact us to exercise any GDPR right.
Cyber Security Act (NIS2)
Article 21 pulls your suppliers into your own risk management, and you need evidence a regulator will accept. See what we provide and what we will sign.
EU AI Act
For AI agents or analytics inside the Act's scope we design for its obligations from the start: documented purpose and risk classification, human oversight, logging, and hard limits on what a model can reach. Read AI agents done right.
DORA
For financial entities, DORA extends resilience obligations to ICT third parties. We help you keep the register of information, meet its contractual requirements and plan for exit and continuity.
Data residency and sovereignty
Residency alone stopped being the whole question. We design for provable control over identity, access and operations, using Sovereign Landing Zone controls where they apply. See Sovereign Landing Zones in 2026.
EU Data Act
Since September 2025 you have the right to move between cloud providers without punitive fees or technical lock-in. We build for that anyway: infrastructure as code, documented data formats, and an exit path agreed before you need it rather than after.
NIS2 supply chain
Verifiable evidence and contractual assurances
You stay accountable for your supply chain and must be able to demonstrate it. A supplier's confidence is not evidence. ISO 27001 is not a Cyber Security Act (NIS2) certification: it is audited evidence across most of the control areas the Cyber Security Act (NIS2) asks about, and the basis for the terms below.
Evidence you can put in front of an auditor
- Accredited ISO 27001:2022 certificate with scope and certificate number, verifiable with the certification body.
- Statement of Applicability summary, Annex A controls implemented and justification for any exclusion.
- Audit and review records: dates and outcomes of internal audit, management review and surveillance audit.
- Completed supplier security questionnaire in your format, signed by a named accountable person.
- Sub-processor register: each party, what it processes, where hosted, under whose jurisdiction.
- Incident response and continuity summaries, with escalation path and last test dates.
- Personnel assurance: pre-employment screening and completed annual security training.
Commitments we will sign
- Incident notification inside an agreed window, aligned to your 24-hour early warning and 72-hour deadlines, so your clock is never started by our silence.
- A named security contact and escalation path in the contract, not a shared inbox found mid-incident.
- Audit and inspection rights, to assess the controls relevant to your engagement or accept an independent report.
- Cooperation with your regulator and your reporting duties, including the facts you need to file.
- Flow-down obligations to any sub-processor on your engagement, with advance notice of changes.
- Defined security requirements per engagement: access model, data handling, retention, and return or deletion at exit.
- Vulnerability and patch handling for anything we build or operate for you.
Privacy and documents
Policies and legal documents
Published documents need no request. The rest we send within five working days.
Published
- Privacy Policy - what personal data we collect and why.Live
- Terms and Conditions - the general conditions for our services.Live
- ISO 27001:2022 certificate - with its full scope statement.PDF
- Microsoft Partner confirmation - Solutions Partner designation as confirmed by Microsoft.PDF
Available on request
- Data Processing Agreement, aligned to GDPR Article 28.On request
- Current sub-processor list, with locations and purpose.On request
- Statement of Applicability summary and ISO 27001 scope detail.On request
- Completed security questionnaires and supplier assessments.On request
- Incident response and business continuity summaries.On request
- Insurance certificates and proof of professional indemnity cover.On request
Legal and reporting
Who you contract with, and how to reach us
Contracting entity
Masterminds Group operates from the Netherlands, the United Kingdom and Germany. Office addresses are in the footer of every page.
- Legal name
- Data Masterminds B.V.
- Registered office
- Amsterdam, Netherlands
- Chamber of Commerce
- KvK 70022526
- Governing law
- Netherlands
- Ownership
- Privately held, owner-managed. No external investors and no parent company outside the EU.
Reporting a security concern
If you believe you have found a vulnerability in our systems, or you need to report a security incident that involves us, email sander@masterminds.io with enough detail for us to reproduce it.
We will acknowledge your report and keep you updated while we investigate. We do not pursue legal action against researchers who report in good faith and give us reasonable time to respond before disclosing.
Need a document or an answer?
Send us your questionnaire, your DPA or the single question holding up a decision. You will get a named person and a realistic date, not a ticket number.