NPE Holding B.V. / HEA World · English · v3.1 · 7 September 2026

NIS2 Intake Questionnaire

Self-assessment with answers and public evidence. No score on this copy. Not a certification and not a claim that NIS2 already applies.

Trust & NIS2 URL book

Organisation context

HEA World is a solo-founder Netherlands SaaS operated by NPE Holding B.V. (Naarden). Nicolas Payen is owner, Security/Ops, and the only company operator. There is one company laptop. This questionnaire is a readiness mapping, not ISO 27001 certification and not a claim that NIS2 already applies to NPE Holding.

Solo founder Q1, Q6, Q16, Q17, and Q18 are answered Yes in proportion to a one-person company. Q25 is No: no supplier has standing access to HEA systems or customer data. Supporting links under each answer are public pages.

Public evidence index

1

Organisation & policy

1. Formal information security policy

Is there a formal information security policy in the organisation?

YesSolo founder Written information-security policy adopted by Nicolas Payen on 5 September 2026. For a one-person company that is the formal policy. Residual sits in Q5: first quarterly review not held. Not an ISO ISMS.

Public Trust — principles · Trust — compliance roadmap (ISO 27001 not claimed)

2. Cybersecurity at management level

Is cybersecurity discussed structurally at management level?

Yes Founder-led: security is a named critical domain with owner sign-off on design notes and deploys. There is no separate board ISMS cycle — that gap sits in Q5.

Public Trust — secure operational foundation · Security contact

3. Documented responsibilities

Are IT and security roles and responsibilities clearly recorded?

Partial Owner = Nicolas Payen. Secondary security-intake role is written and unassigned (external / counsel / MSP later). No formal RACI beyond that.

Public Trust — shared responsibility · security.txt

4. IT risk assessment

Are IT and cybersecurity risks actively identified and assessed?

Partial Every material change carries a P0/P1/P2 class plus blast analysis. Public trust page maps the compliance roadmap. No recurring formal risk-assessment paper or legal NIS2-entity classification.

Public Trust — compliance roadmap · NIS2 Directive (EU) 2022/2555 (legal text; not a claim of applicability)

5. Policy & updates

Is the information security policy periodically evaluated and updated?

Partial Adopted policy has a quarterly agenda. First review due 5 December 2026. Not yet held.

Public Trust — compliance roadmap

2

IT & assets

6. IT asset overview

Is there a current and complete overview of all IT assets?

YesSolo founder Company estate is the public sub-processor list, cloud registers, owner consoles, and one company MacBook Pro. That is the complete company inventory. Second Mac and iPhone are personal and out of scope.

Public Sub-processors · Trust — data & infrastructure

7. Updates & patch management

Are software updates and security patches applied automatically?

Partial Platform patching is on Vercel and Cloudflare. Application dependencies are pinned. No documented automatic endpoint / OS patch programme for the company laptop.

Public Vercel security · Cloudflare Trust Hub · Trust — data & infrastructure

8. Lifecycle management

Is lifecycle management in place for hardware and software?

Partial Software lifecycle is real (publish / revert, package contract, exact pins). Hardware lifecycle is informal; the company is cloud-first with one owned laptop.

Public Trust — backups, recovery, and rollback · Trust — secure operational foundation

9. Critical systems identified

Are business-critical systems and applications clearly identified?

Yes Named critical domains: auth, user access & HEA sharing, billing, metering, transfer/publish, chat engine, foundry, data privacy, cybersecurity, build/deploy. Infrastructure counterparts are listed on the public sub-processor page.

Public Trust — secure operational foundation · Sub-processors

10. Secure equipment disposal

Are old devices and data removed securely and according to policy?

Partial Cloud deletion and retention exist (privacy / DPA paths). No written media-wipe / device-disposal procedure for the company laptop.

Public Privacy policy · Customer DPA

3

Security

11. Is MFA active?

Is multi-factor authentication in use on relevant systems?

Yes Owner confirmed 5 September 2026: MFA on infrastructure, development tools, and email consoles (Clerk, Cloudflare/Google, Vercel, GitHub, Stripe, Upstash, Resend, OpenAI, Anthropic, Meta, Cookiebot). Does not claim Clerk forces MFA on every HEA customer account.

Public Trust — authentication (shared responsibility) · Clerk session / MFA docs

12. Is endpoint security active?

Is endpoint protection (device security) active?

Partial One company MacBook Pro, self-managed: FileVault, lock screen, and updates required. Second MacBook and iPhone are personal. No MDM / EDR.

Public Trust — secure operational foundation

13. Are access rights controlled?

Are access rights managed and enforced?

Yes Clerk sessions, admin role checks, per-HEA isolation, fail-hard transfer/publish. Access control is a verified engineering control, not only a policy sentence.

Public Trust — private by design · Trust — authentication · Customer DPA

14. Is there visibility into access rights?

Is there a current picture of who can access what?

Partial Dated access review (6 July 2026, MFA confirmed 5 September 2026) lists consoles and known holders. Review cadence is not yet a closed quarterly loop; collaborator-role evidence is still a gap.

Public Trust — authentication · Security contact

15. Is network segmentation applied?

Is the network / environment segmented?

Partial Cloud equivalent: public vs admin vs widget CSP, secure / encrypted / public R2 tiers, preview vs production. Not a corporate LAN / VLAN programme.

Public Trust — data residency & storage tiers · Trust — private by design

4

Incidents

16. Is there an incident response plan?

Does a written incident-response plan exist?

YesSolo founder Written vulnerability / incident intake plus a signed paper tabletop (5 September 2026). For a one-person company that is the IR plan. Residual: no NIS2 regulator notification template; deputy unassigned.

Public security.txt · Trust — incident response (Active) · Contact security

17. Do people know what to do in an incident?

Would the people involved know the first steps?

YesSolo founder The people involved are the founder. He wrote and signed the tabletop. There is no staff to train. Residual: deputy unassigned if the owner is offline (Q3).

Public security.txt · Contact security

18. Are incidents tested?

Are incident scenarios exercised (tabletop or similar)?

YesSolo founder The question allows tabletop. Dated paper drill 5 September 2026 (leaked OpenAI key + Clerk takeover), signed by the founder. Not a timed live / red-team exercise.

Public Trust — incident response · security.txt

19. Are backups tested?

Are backups restored or otherwise proven?

Partial Once-per-day KV snapshot to secure object storage plus written RTO/RPO and restore procedure. A restore test has not been executed (not a current priority).

Public Trust — backups, recovery, and rollback · Trust — data & infrastructure

20. Is monitoring applied?

Is operational / security monitoring in place?

Yes Live public status page (15-minute probes of API, KV, R2, D1, Foundry plus Vercel, Cloudflare, OpenAI, Clerk, Stripe, Google Cloud). External NPEHolding watchdog. Cron calendar (backup, model qualification, billing health, smoketest). Hourly system-error digest emails on model-call / output failures. Cybersecurity and deploy-parity gates on every preview and production build. Residual: no third-party SIEM and not a 24/7 SOC — that is tooling, not “monitoring is absent.”

Public Live status page · Trust — secure operational foundation · Trust — incident detection

5

Suppliers & supply chain

21. Do you work with IT suppliers?

Does the organisation use IT suppliers / processors?

Yes Cloud-native. High-criticality path: Clerk, Vercel, Cloudflare, Stripe, OpenAI, Google Cloud, Upstash, Resend, Meta/WhatsApp, GitHub. Medium/low connectors also exist and are listed where they process personal data.

Public Sub-processors · Trust — infrastructure & model providers

22. Are suppliers assessed on security?

Are suppliers reviewed for security?

Partial Selection policy: high-criticality IT / Cloud / SaaS is limited to established Tier 1 industry providers, then owner DPA review (5 September 2026). That is vendor selection, not a questionnaire or collected SOC 2 / ISO pack. Medium/low vendors were not in that pass.

Public Sub-processors · Trust — vendor/subprocessor review · Clerk DPA · Vercel DPA · Cloudflare DPA · Stripe DPA · OpenAI DPA · Google Cloud DPA · Upstash DPA · Resend DPA · Meta DPA · GitHub DPA

23. Are security requirements contractual?

Are security requirements written into contracts / DPAs?

Yes Customer DPA is published. Standard vendor DPAs for the ten high-criticality processors were owner-reviewed on 5 September 2026 (no objections). These are vendor paper, not custom HEA security schedules.

Public HEA World customer DPA · Terms · Clerk DPA · Vercel DPA · Cloudflare DPA · Stripe DPA · OpenAI DPA · Google Cloud DPA · Upstash DPA · Resend DPA · Meta DPA · GitHub DPA

24. Is there insight into supply-chain risks?

Are chain / subprocessor risks understood?

Partial Criticality, region, and owner-reviewed high-criticality DPAs exist. Public sub-processor page states EU vs SCC locations. A per-vendor transfer / SCC column is not yet filled in the internal register.

Public Sub-processors (locations / SCCs) · Customer DPA · Trust — data residency

25. Do suppliers have access to systems or data?

Can suppliers reach systems or personal / customer data?

NoNo supplier has standing access to HEA systems or personal / customer data. No MSP, no vendor login, no shared admin, no jump host. Consoles are owner-held only. Q21 remains Yes — Tier 1 SaaS run their own clouds under DPA. That is not supplier reach into HEA.

Public Trust — shared responsibility · Sub-processors · Customer DPA

i

Company details

Public company and legal pages: hea-world.com · Trust · Privacy · DPA · Sub-processors · security.txt · Status · Contact.