Trust at Plate: security, privacy and compliance

Transparent about how we protect your websites and data

Because Plate takes full responsibility for the hosting, security and uptime of your CMS, we are open about how we do it. Below you will find our certification, the measures built into every site, and the policies behind them.

Secure infrastructure, hosted in Europe 🇪🇺

Delta runs on a managed container platform at a European hosting partner. Infrastructure is managed as code and deployed through version-controlled pipelines, so every change is reviewed and traceable. Traffic is encrypted with HTTPS, and certificates are renewed automatically.

Data privacy by design

We apply privacy by design and by default, and process personal data in line with the GDPR. Data is protected in transit and at rest and kept no longer than needed, and engineers have no access to sensitive production data by default. An assurance statement with our implemented controls is available on request.

Secure development

Security is part of the design of every feature. Code is peer-reviewed by a second engineer and covered by automated tests, and every pull request is scanned for vulnerabilities. Tests never use production data, and findings are fixed by severity, with high-severity issues resolved within a week.

Officially ISO 27001 certified

Plate Websites B.V. is certified against ISO/IEC 27001:2022 (incl. Amd1:2024) by ProCertify. The scope covers information security related to the development, management and support of the Plate CMS platform.

Certificate number 27001 09102026.1. Valid from 9 October 2026 until 9 October 2029.

Built to stay available and recoverable

We design Delta so that problems stay small and recovery stays predictable: managed European infrastructure, automated deployments with fast rollbacks, and documented runbooks for the failure scenarios we have identified. Business continuity and backups are part of our ISO 27001 management system.

Backups and recovery

Databases are backed up daily with point-in-time recovery, and copies are stored in a separate datacenter. We test our restore procedure at least once a year and document the result.

Monitoring and incident response

Alerts watch platform health, errors and response times, so we can react quickly. Incidents follow a documented process, and we practise disaster recovery with regular drills.