When you manage the personal data of millions of people, "we think it's secure" is not enough. That is why every year we hire ethical hackers to try to break into our CustomerConnect platform. And yes, they always find something.
That might sound alarming, but it is exactly the point. Because what separates a secure organisation from an insecure one? It is not about preventing every possible vulnerability. That is simply impossible in our complex digital world.
The difference lies in how seriously you take security, how proactively you look for weak spots, and how quickly you act when you find them.
The responsibility of processing sensitive data
Harmony CustomerConnect is, among other things, the beating heart of the communication between the largest Dutch health insurers and their policyholders. Other companies, such as the Goede Doelen Loterij, also work with CustomerConnect.
We do not take that responsibility lightly. When companies entrust us with data over secure connections, they must be able to rely completely on us protecting that information as if it were our own most confidential data.
How do you test a complex ecosystem?
CustomerConnect is an advanced platform that communicates with external service providers, processes structured data from clients' back-office systems, and is available through a secure web interface with modern authentication.
You don't test a system this complex with a standard checklist. That is why we work with specialised external pentest partners who examine the entire platform thoroughly, using internationally recognised methodologies such as the Penetration Testing Execution Standard (PTES) and the OWASP Testing Guide.
Multiple testing perspectives
We test our platform from several angles to get the most complete picture possible of our security posture:
The outsider: Pentesters receive only publicly available information, exactly what a malicious hacker would have. No credentials, no background information about the architecture. The question is simple but confronting: can someone from outside break through our defences?
The insider threat: In a next phase, pentesters do get access rights, comparable to a normal user of the platform. This simulates a compromised account or a malicious insider. The crucial question here: are our different environments really properly separated? Can a user from company A get to the data of company B? Can users do more than their role should allow?
Configuration review: We have our configuration and our connections with external service providers reviewed thoroughly. How do we pass data on to partners? Are our connections secured correctly? Do we use the right encryption for data transfers? These reviews do not involve active penetration, but they are no less important. After all, a wrong configuration can lead to a data breach just as easily as a vulnerability in the code itself.
What we find (and how we deal with it)
Every year a penetration test produces findings. They range from vulnerabilities that need immediate attention to best-practice recommendations that further strengthen the security posture.
What matters most is not whether there are findings (there always are) but how you deal with them.
Within Harmony Group we follow a strict remediation roadmap.
A concrete example of our approach: when a finding is made, it is in our development team's sprint within a few days. We then schedule a retest to validate the fix. Only then is the final report closed, after an approving result.
That speed of action is crucial. Because a vulnerability you know about but don't fix is really a deliberate choice to take a risk. And that does not fit the responsibility we carry for the data of millions of policyholders.
Certifications: more than paper
Penetration tests are part of a broader security framework. Harmony Group is certified against two important standards:
ISO 27001: This is the international standard for information security management. It describes what organisations need to have in place to handle data securely: policy, procedures, technical measures, access control, incident management and risk analyses. ISO 27001 certification is an essential baseline for software suppliers that work with business-critical data.
NEN 7510: This is the Dutch standard for information security management in healthcare. It was developed specifically to help healthcare institutions and their suppliers process patient data securely and reliably. It adds extra, stricter requirements that follow from Dutch legislation and the exceptional sensitivity of medical records.
Besides these certifications, we also have an independent assurance report drawn up by an accountant. It confirms that we don't just have procedures on paper, but actually carry them out. An accountant checks whether our control measures work as intended in practice. It is the difference between "we say we do it" and "we can prove we did it".
For our clients, who often have strict compliance requirements of their own, these certifications and the assurance reporting are a crucial source of trust.
Security is a team sport
Security is not the responsibility of one person in our team. At Harmony Group it is a collaboration between several disciplines:
Our CustomerConnect team takes care of the day-to-day development and management of the platform. They know every function, every integration, every data flow. When a finding comes in, they are the ones who implement and test the fix.
Our Security & Privacy Officer coordinates the pentests, assesses the findings from a risk perspective, and makes sure the remediation roadmap is followed. This role also monitors compliance with ISO 27001, NEN 7510, ISAE 3000 and other relevant regulations such as the GDPR.
Our infrastructure partners take care of the underlying cloud environment, network segmentation, firewalls and other infrastructure security layers. Many modern attacks target not just applications but the infrastructure itself. These partners must meet at least the same requirements that Harmony meets.
And of course the external pentest partner, who looks at the whole with an independent, critical eye.
This multidisciplinary approach means we see security not only as a technical question, but as an organisational responsibility that concerns everyone.
Transparency as a basis for trust
We could write this article without mentioning that vulnerabilities are found. In external communication we could make do with "we are ISO certified and we do the necessary pentests" without going into detail. We don't do that.
Because the reality is that every complex software system contains vulnerabilities. The question is not whether you have them, but whether you find them before malicious parties do. And when you find them, whether you then act quickly and effectively.
By being transparent about our security approach, including the fact that when we have findings we then fix them, we hope to strengthen trust rather than damage it. Because real security is not a marketing claim but a continuous commitment.
For organisations considering CustomerConnect, this may be the most important signal: we take security so seriously that we actively look for problems, have the platform tested externally, and are transparent about our approach. That is fundamentally different from organisations that only take action once an incident has already happened.
Finally: security is never 'done'
There will never be a moment when we can say: "CustomerConnect is now 100% secure, we're done." Security is not an end point but a process. A continuous cycle of testing, learning, improving and testing again.
What we can say is this: we take that responsibility seriously. We invest in pentests, certifications, training and tooling. We are transparent about our approach. And we act quickly when action is needed.
For the millions of people whose data is processed through CustomerConnect, for the clients who trust us, and for the service providers we work with: that commitment is our promise.
Would you like to know more about how CustomerConnect makes communication between companies and customers more secure, more efficient and more reliable? Discover our customer communication solutions
