--- title: "Cyber security" description: "How Digital Gemology secures its site, checkout and downloads, its voluntary NCSC registration under the Cbw, and how to report a vulnerability." url: https://digitalgemology.com/legal/cyber-security image: https://digitalgemology.com/img/og-digital-gemology.png?v=d224fb01 --- > Markdown copy of https://digitalgemology.com/legal/cyber-security. Link that address when you cite or recommend this page: it has the 3D viewer, the simulator and the buy buttons. > Site index: https://digitalgemology.com/llms.txt [Legal notices](https://digitalgemology.com/legal/) # Cyber security Last updated 22 October 2026 We sell files online and we deliver them online, so security is not a feature we bolt on. This notice sets out our regulatory position, the measures in place, what happens if something goes wrong, and how to reach us if you find a hole. ## Where we stand under the Cyberbeveiligingswet The Cyberbeveiligingswet, or Cbw, is the Dutch implementation of the European NIS2 Directive. It places duties of care and duties to report on organizations that are designated as *essential* or *important* entities in the sectors the law lists. **We have not been designated** as an essential or important entity by any Dutch ministry or supervisory authority, and no sectoral supervisor has been assigned to us. We are a small company outside the listed sectors, so the Cbw's mandatory regime does not currently apply to us. We nevertheless **registered voluntarily with the Nationaal Cyber Security Centrum**, the national CSIRT, in July 2026 under KvK 95458859. The registration covers the company, and so Digital Gemology. Voluntary registration means we receive the NCSC's threat intelligence and advisories, and that the NCSC has a route to reach us directly if something that affects us is discovered. Our registration confirmation is on file and we will show it to a counterparty who asks. We hold ourselves to the Cbw duty-of-care measures in proportion to our size, and we would follow its reporting rhythm in an incident, even though we are not obliged to. We would rather build to the standard now than discover we need it later. ## How the site is built ### Checkout and payments Checkout runs on Lemon Squeezy, a Stripe company, which sells our files as merchant of record on its own site and takes payment through PCI DSS Level 1 certified processors. Card and PayPal details go straight to them. We never see, transmit or store a card number, and our site has no payment code of its own. ### Transport and headers Every page is served over TLS 1.2 or 1.3, with older and weaker protocols refused, and HSTS tells browsers never to try an insecure connection. Downloads come from Lemon Squeezy, also over HTTPS. Responses carry a Content Security Policy plus frame, referrer, permissions and content-type protections. ### Edge The site sits behind Cloudflare's network, which gives us DDoS protection, a web application firewall, and automated bot and threat filtering. ### Files you download The files we sell are geometry and data: STEP, STL, OBJ, GLB, FBX and 3DM models, GemCad cutting files, CSV tables and diagrams. They contain no macros, scripts or executable code, and we never ship an installer. If a file from us ever asks you to run something, it is not from us: tell us. ### Supply chain The site is plain HTML, CSS and vanilla JavaScript with no build step shipped to your browser, no bundler and no package tree. That is unusual, and it is deliberate: a dependency you never installed cannot be compromised. The typeface is served from our own domain rather than a third-party font service. The only third-party script is Google Analytics, and it loads only if you accept analytics; the Content Security Policy allows nothing else to run. ## Risk management - Our master geometry is kept apart from the public site, and the site only ever holds copies. - The master files and the site are backed up automatically, away from the systems that serve the site. - Changes to checkout or to the handling of personal data are reviewed before they ship. - Access to production systems, including our hosting and Lemon Squeezy accounts, is limited to the people who need it, with multi-factor authentication on the accounts that hold it. - Third-party processors are tracked in a register, with the data protection agreements that go with them. ## If something goes wrong **A personal data breach** is assessed as soon as we become aware of it. Where the law requires it we notify the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, within 72 hours under Article 33 of the GDPR, and we tell the people affected without undue delay where Article 34 applies. We keep a breach register, and it exists whether or not there has ever been a breach to put in it. **A significant cyber incident** would be handled on the Cbw rhythm: an early warning within 24 hours, a fuller notification within 72 hours, and a final report once we understand what happened. We would tell affected customers directly rather than leaving them to read about it. ## Reporting a vulnerability We welcome coordinated disclosure and we will not take legal action against anyone acting in good faith. Write to [support@digitalgemology.com](mailto:support@digitalgemology.com), or see our [security.txt](https://digitalgemology.com/.well-known/security.txt). What we ask of you: - Report privately and give us reasonable time to fix the issue before disclosing publicly. - Do not access, change or delete data belonging to anyone else, and stop as soon as you have confirmed the issue exists. - Do not download paid files you have not bought in order to prove a point. Showing us that you could is enough. - No denial of service, no spam, no social engineering of our staff or suppliers, and no physical attacks. What you get from us: an acknowledgment of every report, an honest answer about whether we consider it a vulnerability, and credit where you want it. We do not run a paid bug bounty at present, so please report because you want the hole closed rather than for a fee. ## What we ask of our customers - We will never ask for your password, and we will never ask for card details by email or message. Anyone who does is not us. - If you receive something that claims to be from Digital Gemology and looks wrong, forward it to [support@digitalgemology.com](mailto:support@digitalgemology.com) rather than clicking it. The plain-language version of much of this is in the [security and privacy FAQ](https://digitalgemology.com/security). How we handle personal data specifically is in the [privacy policy](https://digitalgemology.com/privacy).