When you're responsible for managing the personal data of millions of people, simply thinking "it's secure" simply won't cut it. That's precisely why we engage ethical hackers every year to actively try and breach our CustomerConnect platform. And yes, without fail, they always manage to find something.
That might sound alarming, but that’s entirely the point. What separates a truly secure organisation from one that isn't? It's not about pre-empting every conceivable vulnerability—that’s just a digital fantasy in our complex world.
The true difference lies in how rigorously you approach security, how proactively you hunt for weak spots, and how swiftly you rectify them when they surface.
The weight of processing sensitive data
Harmony CustomerConnect serves, among other things, as the central nervous system for communication between major Dutch health insurers and their policyholders. Other major firms, like the Dutch Postcode Lottery, also rely on the platform.
We don’t take that level of trust lightly. When organisations hand over data to us via secure channels, they need to have implicit faith that we will protect that information as if it were our own most sensitive corporate secrets.
How do you put a complex ecosystem to the test?
CustomerConnect is a sophisticated platform: it liaises with external service providers, processes structured data from client back-office systems, and is accessible via a secure web interface with modern authentication.
A system this intricate can't be tested with a bog-standard checklist. That's why we partner with specialist external penetration testing (pentest) firms. They meticulously scrutinise the entire platform using internationally recognised methodologies, such as the Pentest Execution Standard (PTES) and the OWASP Testing Guide.
Multiple testing perspectives
We test our platform from various angles to build the most comprehensive picture possible of our security posture:
- The Outsider: Pentesters initially only receive publicly available information—mimicking the resources a malicious actor would have. No login details, no background on the architecture. The question is simple but stark: can someone from the outside break through our defences?
- The Insider Threat: In a subsequent phase, pentesters are given legitimate access rights, comparable to a regular platform user. This simulates a compromised account or a malicious insider. The crucial question here is: are our different client environments genuinely segregated? Can a user from Company A gain access to Company B’s data? Are users strictly limited to their appropriate permissions?
- Configuration Review: We commission a thorough review of our configurations and our connections with external service providers. How do we transmit data to our partners? Are our connections correctly secured? Are we deploying the appropriate encryption standards for all data transfers? These reviews don’t involve active penetration but are equally vital. An incorrect configuration can lead to a data breach just as easily as a flaw in the code itself.
What We Find (and How We Action It)
Every year, a penetration test yields findings. These range from vulnerabilities demanding immediate attention to 'best practice' recommendations that simply further strengthen the security posture.
The key takeaway isn't if findings appear—they always will—but how you address them. At Harmony Group, we maintain a stringent remediation roadmap.
A concrete example of our process: when a significant finding is confirmed, it is allocated to our development team’s sprint within a matter of days. We then schedule a mandatory retest to validate the fix. The final report is only officially closed once that retest gives an approving result.
This speed of action is non-negotiable. A vulnerability you are aware of but fail to resolve is, in essence, a conscious decision to carry risk. And that fundamentally contradicts the responsibility we hold for the data of millions of policyholders.
Certifications: More Than Just a Piece of Paper
Penetration tests are just one element of a much wider security framework. Harmony Group holds certifications for two critically important standards:
- ISO 27001: This is the global standard for Information Security Management. It outlines what organisations must have in place to handle data safely: policy, procedures, technical controls, access management, incident handling, and risk analysis. ISO 27001 certification forms the essential baseline for any software provider handling business-critical data.
- NEN 7510: This is the specific Dutch standard for information security management in the healthcare sector. It was developed to support healthcare institutions and their suppliers with the secure processing of patient data, adding extra, stringent requirements derived from Dutch law and the exceptional sensitivity of medical records.
Beyond these certifications, we also have an independent assurance statement prepared by an accountant. This confirms that we don't just have documented procedures; we actively execute them. The accountant verifies that our control measures function exactly as intended in a real-world setting. It’s the difference between saying "we do it" and being able to prove "we've done it."
For our clients, who often have stringent compliance demands of their own, these certifications and assurance reports are a vital source of trust.
Security Is a Team Sport
Security is not the sole domain of one individual within our organisation. At Harmony Group, it’s a genuine collaboration across multiple disciplines:
- Our CustomerConnect Team handles the day-to-day development and management of the platform. They are intimately familiar with every function, every integration, and every data flow. When a finding comes in, they are the ones who design, implement, and test the fix.
- Our Security & Privacy Officer coordinates the pentests, assesses findings from a risk perspective, and ensures the remediation roadmap is strictly adhered to. This role also oversees compliance with ISO 27001, NEN 7510, ISAE 3000, and other relevant regulations such as GDPR.
- Our Infrastructure Partners provide the underlying cloud environment, network segmentation, firewalls, and all other infrastructural security layers. Many modern attacks target the infrastructure itself, not just the application. These partners must meet security standards that are at least as demanding as our own.
- And, of course, the External Pentest Partner who scrutinises the entire picture with an independent, highly critical eye.
This multidisciplinary approach ensures we view security not just as a technical hurdle, but as an organisational responsibility that involves every single person.
Transparency as the bedrock of trust
We could easily have written this piece without mentioning that vulnerabilities are ever found. We could simply settle for external communication stating, "we are ISO certified and carry out the necessary pentests," without offering any detail. We choose not to do that.
The reality is that every complex software system contains vulnerabilities. The right question isn't whether you have them, but whether you can find them before malicious actors do. And once you find them, do you then act quickly and effectively?
By being upfront about our security approach—including the fact that we find vulnerabilities and then resolve them—we hope to build trust, not undermine it. Because genuine security is not a marketing slogan; it is a profound, continuous commitment.
For any organisation considering using CustomerConnect, this is perhaps the most critical signal: we take security so seriously that we actively hunt for issues, have it rigorously tested externally, and are transparent about our methods. That is fundamentally different from organisations that only take action after an incident has already occurred.
Finally: security is never 'done'
There will never be a time when we can confidently declare: "CustomerConnect is now 100% secure; we can stop." Security is not an endpoint; it is a process. A perpetual cycle of testing, learning, improving, and testing again.
What we can promise is this: we take this responsibility with the utmost gravity. We invest in pentests, certifications, training, and tooling. We are fully transparent in our approach. And we move with speed and decisiveness when action is required.
For the millions of people whose data is processed via CustomerConnect, for the clients who place their faith in us, and for the service providers we work alongside: that commitment is our unwavering promise.
Want to know more about how CustomerConnect makes communication between businesses and clients safer, more efficient, and more reliable? Discover our client communication solutions.
.jpeg)
.png)
