Information Security Compliance Statement

WoodWing Group has committed to implementing and maintaining an Information Security Management System, in accordance with the requirements of NEN-EN-ISO/IEC 27001:2023.

We are committed to respecting the privacy of all our customers, developing software with security by design and by default, protecting any customer data from outside parties, and ensuring that their requirements are met, unless otherwise required to do so by law. 
To this end, Management is committed to maintaining a secure environment in which to control and process confidential information. We are also committed to the overall continual improvement of the Information Security Management System, including Management setting and reviewing security objectives.

All of the components of this ISMS are periodically and systematically reviewed by both internal and external audit procedures and parties.

A full-time security officer has been appointed to be responsible for the control of all matters relating to the implementation, control and continuing audit of these procedures.

The implementation and continuing control of the NEN-EN-ISO/IEC 27001:2023 standard are fundamental to all work undertaken by the WoodWing Group. The information security policy is communicated, understood and applied within the organization and is available to relevant interested parties, as appropriate.

We have adopted the process approach for developing, implementing and improving the effectiveness of its ISMS and we are committed to:

• Understanding business information security requirements and the need to establish policy and objectives for information security
• Implementing and operating controls in the context of managing the Group’s overall business risk
• Monitoring and reviewing the performance and effectiveness of the ISMS
• Continual improvement based on objective measures
• Carrying out annual external pentests on all software provided to customers. This year's pentest have been carried out without any major non conformities.
• Communicate throughout the Group the importance of meeting all relevant statutory and regulatory requirements specifically related to its business activities
• Ensuring that adequate resources are determined and provided to monitor and maintain the ISMS.

We firmly believe that certification to NEN-EN-ISO/IEC 27001:2023 essential in our commitment to ensuring information security, customer satisfaction, continued growth and improvement of our company.

Additional compliance for Xtendis
Within the WoodWing Group, Xtendis also complies with:

• NEN 7510, the Dutch healthcare information security standard. This ensures that Xtendis meets sector-specific security requirements for organizations processing healthcare-related information.
• NEN 16175, the standard for the management, authenticity, integrity, and long-term accessibility of electronic documents and records.

These additional standards demonstrate Xtendis’ commitment to addressing the specific needs of customers in healthcare and records management.

The effectiveness of this policy and its compliance will be monitored and periodically reviewed by the WoodWing Group.

Ross Paterson, CEO
Ruben van der Kolk, CISO

September 2025

WoodWing group members: WoodWing, Xtendis (Expansion), and Scienta

WoodWing Certificate Listings

• WoodWing Group
• WoodWing Xtendis