FileCap provides the most secure service possible by taking responsibility for the security of systems, communications, and data throughout the entire chain. Our vision and measures are set forth in the information security policy of Contec B.V. (the developer of FileCap), which was drafted in accordance with the international standard ISO 27001:2022.
FileCap is designed to securely exchange emails and files—within Outlook, Microsoft 365, and the web portal. With FileCap, you can customize security settings to align with your own policies:
In developing and managing FileCap, we follow recognized best practices, including:
ISO 27001 / ISO 27002: the international standard for information security management systems. Contec has been ISO 27001 certified since July 7, 2020; since 2025, we have been certified to the ISO 27001:2022 standard.
NCSC ICT security guidelines for web applications: the guidelines from the National Cyber Security Center serve as a reference framework for our development and management processes.
OWASP Top 10: the ten biggest security risks for web applications identified by the Open Web Application Security Project are incorporated into development, code review, and testing.
Secure Software Development Lifecycle: Security is embedded in our development processes—from design and code review to release and patch management. Administrators can schedule updates to the FileCap server or apply them immediately.
The FileCap SaaS environments are hosted entirely within the European Union. We currently use two EU hosting platforms:
Regardless of the underlying platform, your data will not leave Europe and will not be used for AI training or marketing purposes. Upon request, we will let you know which platform your specific FileCap environment is running on.
Access to your FileCap environment is only possible with a valid account, a strong password, and—for administrators—multi-factor authentication. Your data is always transmitted over an SSL/TLS-encrypted connection.
After logging in, you will have access to only the features you are authorized to use. Based on their roles, administrators, end users, and recipients can be assigned different permissions and authentication requirements.
In line with zero-trust principles, administrator access is being further secured:
We ensure strict compliance with our security measures. Any deviations are detected, investigated, and classified. Based on incidents and the records kept, we implement additional security measures. Customers are notified in accordance with the GDPR and applicable legal reporting requirements if they are affected.
FileCap takes the security of customer data and the safe use of our SaaS solution extremely seriously and actively monitors these aspects. To enable users of our systems to actively contribute to this, you can report any instances of misuse or suspected security vulnerabilities directly to our security team at security@filecap.com.
We ask that you always contact us directly if you suspect any vulnerabilities. We strongly advise against reporting or disclosing information via social media in order to minimize potential risks to those involved.
The quality, security, and privacy of FileCap are demonstrated through certifications and regular audits.
Contec B.V., the provider of FileCap, has been certified to the international ISO 27001 standard for Information Security Management Systems (ISMS) since April 1, 2021. View Contec B.V.’s ISO 27001 certificate.
FileCap complies with the General Data Protection Regulation (GDPR). View Contec B.V.'s privacy statement (PDF).
FileCap meets the requirements set forth in the NIS2 Directive on cyber resilience. The combination of AES 256 encryption, TLS 1.3, MFA, DLP via Business Rules, and a verifiable audit trail supports customers in their own compliance efforts. If your organization does not directly comply with NIS2, FileCap helps you serve as a secure building block in the supply chain for customers who are subject to NIS2.
Regulation (EU) 2022/2554 (the Digital Operational Resilience Act, "DORA") has applied to financial entities in the EU since January 17, 2025, and sets out legal requirements for information security and the management of ICT risks, including where these risks lie with third-party providers.
If your organization is a financial entity as defined by DORA—such as a credit institution, investment firm, payment institution, insurer, insurance intermediary, pension institution, management company, or similar entity—FileCap may qualify as a third-party IT service provider for you.
FileCap supports you in this as follows:
Upon request, we will provide the relevant supplier declarations so that you can include them in your own DORA information register and risk assessment.
Please note that the accountability under DORA remains with you as a financial entity: you remain fully responsible for compliance with DORA and applicable financial law. FileCap does not provide legal advice; for implementation questions, we refer you to your own legal counsel or the relevant supervisory authorities (in the Netherlands, the AFM and DNB; at the European level, the EBA, EIOPA, ESMA, and—for systemic risks—the ESRB).
Would you like to receive our brief explanation of DORA in relation to FileCap, or discuss a DORA addendum? Please contact us at security@filecap.com.
FileCap complies with WCAG 2.0 for digital accessibility.
The FileCap infrastructure and software are assessed for vulnerabilities whenever significant functional or technical changes are made. We conduct this assessment in-house, followed by the classification and follow-up of findings.
In addition, we continuously use external scanning tools to check for vulnerabilities in the FileCap environment and its underlying components. Any vulnerabilities found are actively tracked and—depending on their impact—resolved or mitigated, and patches and updates are applied according to an established release process. In response to ad hoc requests from customers, we facilitate—in consultation—penetration tests on their own FileCap environment.
FileCap SaaS environments run on cloud infrastructure designed for high availability, either on Scaleway or in AWS EU regions. This ensures that, in the event of a component failure, service can continue without interruption for the end user.
To safeguard data and configurations, backups are performed periodically. Administrators can request a backup of their environment upon request. The restore functionality, which is available only to authorized FileCap personnel, is used to restore backups.
Our recovery procedures are tested on a regular basis. Findings are classified and followed up; to date, these tests have not revealed any major issues. The backup system is intended for disaster recovery, not for archiving individual customers’ data.
Backups of the SaaS platforms are stored in the Netherlands, with at least one copy always stored off-site.
Our business continuity planning focuses on both the SaaS environment and the support provided by our support team. We have established contractual agreements with our suppliers—including Scaleway and AWS (EU) as hosting partners and our SMS provider—regarding availability, security, and data protection.
FileCap is provided as a SaaS service. Responsibility for security and compliance is shared:
FileCap / Contec is responsible for:
The customer is responsible for:
A detailed breakdown can be provided upon request, for example, as part of a supplier assessment or a DPIA.
If you entrust (parts of) your business processes for secure email and file sharing to FileCap, you want to be sure that this is done in a controlled and reliable manner. The quality standards, level of information security, and privacy must meet your expectations, the agreed-upon service terms, and current laws and regulations.
FileCap, developed and managed by Contec B.V., has been recognized for over fifteen years as a reliable partner for encrypted email and file transfer. With an ISO 27001-certified ISMS, hosting within the EU, strong encryption, and a transparent division of responsibilities, we help you maintain control over the information flows you entrust to FileCap.
Do you have questions about this page or a specific security measure? Please contact us at security@filecap.com.
