Security at Nerd as a Service

Nerd as a Service B.V., the company behind yrso, has an ISO 27001-certified information security management system. We are a small company entrusted with information that matters to our customers. We chose independent assessment of how we manage that responsibility.

Independent scrutiny for a small company

Customers should be able to ask us the same substantive security questions they would ask a larger supplier. Who is responsible for a risk? What evidence supports a control? How will the service recover after a failure?

Certification gives those conversations an independently assessed basis. It requires work inside the company: assigning responsibility, making risk decisions and retaining evidence of how the management system operates. The size of our team makes clear ownership especially valuable.

The certification concerns our ISMS

An information security management system, or ISMS, is the set of processes an organisation uses to manage information security risks. ISO 27001 sets requirements for that system.

KIWA issued our ISO 27001 certificate on 20 February 2025, with a validity period of three years. The certified scope is:

Securing information in relation to rendering information security advisory services to clients and the development of supportive web-based software

This covers our information security advisory services and the development of supporting software, including yrso.

Request a copy of the certificate for your supplier review.

Engineering work beyond the certificate

We put effort into making yrso understandable and recoverable. Our NixOS configuration lets us reproduce the server environment. The Go application and SQLite databases keep the deployment small enough for our team to operate directly.

Those are deliberate implementation choices. ISO 27001 does not prescribe NixOS or SQLite. We choose them because they help us reduce manual server setup and make the inputs to recovery explicit.

A replacement server can run the same configuration and application release, with the databases restored from consistent backups. Uploaded evidence and the required credentials remain part of that recovery process. Our technical walkthrough explains the stack and the dependencies involved.

Evidence customers can examine

We want security discussions to reach the actual controls and their evidence. If a questionnaire needs a more precise answer about our scope or a particular service, ask us. A broad claim that we “take security seriously” should never be the only answer available to you.

For customers building their own management system, our guides cover practical questions about certification, restore tests and audit findings. Our tool + team service provides support with the work behind those assessments.