Is digital sovereignty a topic within your organization?
Digital sovereignty: for us, not an accidental choice, but a deliberate one. As a Dutch family business, we build and manage our contract management software entirely in the Netherlands, from a European positioning.
The risks for your organization?
Staying in control of your digital environment is not a given. That control is under pressure from foreign legislation, international ownership structures and geopolitical developments. And even if your data is physically located in Europe, that does not yet give you full control over your data, systems and continuity.
These are the risks you are dealing with:
Digital sovereignty therefore calls for a realistic, risk-based approach. Not just looking at functionality and innovation, but above all at control, continuity and demonstrable safeguarding.
Why jurisdiction matters, not just server location
Many organizations assume their data is safe as soon as the servers are located in Europe. But server location is not the same as jurisdiction: the US CLOUD Act allows US authorities to claim data from a supplier that falls under US law, regardless of where the servers are physically located.
GRIP is a Dutch company. The processing of your contract data takes place exclusively via European parties, under European law — so outside the reach of the CLOUD Act.
Exclusively European platforms for data processing
The contract data you enter into GRIP is processed exclusively by parties that fall under European jurisdiction. That applies to storage, hosting and to the AI processing in the platform.
ISO 27001 certified
GRIP is certified according to ISO 27001:2022 (information security) and ISO 9001:2015 (quality management). The certificate numbers are NL-2596.1.1 and NL-2597.1.1. You can view the current certificates via the ISO certification page.
View the ISO certificatesGDPR-proof by design
The GDPR requires that personal data is processed exclusively within the European Economic Area, or with appropriate safeguards. GRIP meets both requirements: all processing takes place within the EEA, and a data processing agreement is in place for every sub-processor.
As a contract manager or IT manager, you don’t have to guess about the processing chain. It is European and demonstrable.
NIS-2 and the Cybersecurity Act
The NIS-2 directive and the Dutch Cybersecurity Act set requirements for the information security of organizations in critical sectors, and for their suppliers. GRIP actively contributes to the security requirements that apply to NIS-2-obligated organizations. The ISO 27001 certification, the GDPR-compliant processing chain and European jurisdiction form the basis for this.
Frequently asked questions about data and security
The CLOUD Act is a US law that allows US authorities to request data from companies that fall under US law, even if that data is physically stored in Europe. What matters is not the location of the servers, but the legal control over the supplier. GRIP is a Dutch company and processes contract data exclusively via parties that fall under European law. The CLOUD Act does not apply to the processing of your contract data in GRIP.
The contract data you enter into GRIP is stored and processed exclusively via European platforms within the European Economic Area. For the AI processing of contract data, GRIP works together with Mistral AI SAS, based in France. Data processing agreements are in place in line with the GDPR.
GRIP is certified according to ISO 27001:2022 (information security) and ISO 9001:2015 (quality management). The certificate numbers are NL-2596.1.1 and NL-2597.1.1. The full certificates and additional documentation are available via the ISO certification page.
A data processing agreement (DPA) is a contract required under the GDPR when an organization has personal data processed by a third party. GRIP has data processing agreements with all its sub-processors. As a customer, you receive a data processing agreement from GRIP for the processing of your contract data.
GRIP actively contributes to the security requirements that NIS-2-obligated organizations set for their suppliers. The ISO 27001 certification, the GDPR-compliant processing chain and European jurisdiction form a demonstrable basis for this. More details can be found on the NIS-2 page.
GRIP processes personal data exclusively within the EEA. A data processing agreement is in place for every sub-processor. The entire processing chain falls under European law. There is no US jurisdiction involved in the processing of your contract data.
European jurisdiction means that all parties that process your contract data fall under European law, including the GDPR. Foreign governments (such as the US via the CLOUD Act) cannot compel these parties to provide data outside the European legal framework. For your organization, this means demonstrable control over where your data ends up and who has legal access to it.
Questions about your data compliance?
Many organizations in government, healthcare and education are setting increasingly concrete requirements for their SaaS suppliers. If you have questions about how GRIP handles your contract data, which sub-processors are involved or which documentation is available, we are happy to answer them.