Value Adding
|

How we work

Compliance & how we work

Six commitments we arrange up front. Per topic below: what it means concretely, in code, in contract and in collaboration.

EU hosting

We host by default at Hetzner (EU data centres) or AWS EU (Frankfurt or Ireland region). For clients with stricter requirements, hosting on your own infrastructure is possible. No data traffic to the US without Standard Contractual Clauses.

You get by default: DPA, sub-processor list, and audit rights.

GDPR compliance

We are GDPR-compliant. In concrete terms that means:

  • data minimisation as a starting point
  • clear retention policy
  • consent flows where required
  • right-to-erasure implementation
  • audit logging on sensitive actions
  • encryption-at-rest and -in-transit by default

Where relevant we apply Privacy by Design principles. We don't claim that as a brand promise until we can fully substantiate it.

No outsourcing, one team in the Netherlands

All development happens within our own Dutch team. No junior placements on your project. No offshore partners.

What this means for you: continuity, direct contact without intermediaries, one responsible party for your system. Based in Wijchen.

Source code and IP yours

By default, you own the source code and intellectual property of what we build for you. Repository handover is a standard part of delivery.

You choose which model fits:

  • If you buy the software, you own everything
  • If you take it as Software-as-a-Service, we deliver and operate
  • Hybrid: you own the core, we run for example the AI layer

That choice is made at intake, clearly and contractually fixed. No platform lock-in on proprietary frameworks.

ISO 27001 principles

We are not formally certified, and we say that honestly. What we do: our team is trained in industrial engineering and has the ability to audit ISO 27001 and related frameworks ourselves. We apply the principles because we understand what goes on under the hood:

  • Role-based access control (RBAC)
  • Incident logging and audit trail
  • Encryption-at-rest and -in-transit by default
  • Secrets management (Vault or equivalent)
  • Dependency scanning (Dependabot or equivalent)
  • Code reviews on every pull request
  • Least-privilege principle across all infrastructure

Penetration testing on request.

Since 2020 · long-term partnerships

Value Adding was founded in 2020. Founder Mike Smit has worked in operations and software development since 2015.

Several clients have moved from project delivery to long-term partnerships. What started as a build became monitoring, updates, optimisation and continued development by the same people who built it.

References available on request.

See our cases

Question about a specific commitment?

Plan 30 minutes. We'll answer it personally, without sales pitch.