Security and Privacy

At Drieam we place security as the highest priority in the operations of our suite of products and services. We strive to continuously provide a robust set of security measures and practices to guarantee the privacy & security of our customers’ data. Therefore, we always work in line with our Data Protection policy, meaning we carefully deal with all collected and processed data and that we comply with the applicable legislation, including the General Data Protection Regulation (GDPR) and its Implementing Act.

Privacy Policy

In our Privacy Policy, you will find information about how, whether, and why we collect and use personal information with our apps and systems.


Security Measures

At Drieam we take adequate technical and organisational measures to make sure our customers’ data is secure and protected. The key principles which we use for this purpose are Security by Design (like data minimisation) and Security by Default. Moreover, we periodically carry out internal audits in line with the IT security guidelines for web applications, defined by the Dutch National Cyber Security Centrum (NCSC).

Responsible Disclosure

Despite our dedicated measures to ensure the security and privacy within our apps and systems, it still can happen that a vulnerability occurs. Therefore, further to our own actions to find possible vulnerabilities, at Drieam we are always open for notifications about weaknesses that can be found by others. A vulnerability in one of our systems can be notified directly to our security officer ( Together with the notification, we kindly request an extensive description of the found vulnerability, so we can reproduce and resolve it. Moreover, we kindly request the reporter to not share the identified vulnerability with others; notifications will always be treated as confidential information. For each notification, elements cannot be downloaded, changed or removed. We strive to solve any found vulnerabilities as soon as possible and to make sure they will not occur again.

Our Partners

When performing our services, our partners might have access to personal data. They are, therefore, (sub-)processors of personal data as referred to in article 4 of the General Data Protection Regulation (GDPR). At Drieam, we take several measures to ensure that this data is processed in a safe and responsible way, in line with article 28(2) of the GDPR.

When possible, we keep data in Europe and we concluded a data processing agreement (DPA) with each of our partners. In addition, we only work with partners located in the European Union, or at the United States, provided they comply with the GDPR rules and regulations when processing our data. Below you find the updated list of the partners, which might have access to the processed/ collected data by Drieam:

Sub-processorPurposeCountry of processingCertificationCountry entityRemarks
Amazon Web Services (AWS)AWS is used to host, backup and process Drieam’s web applications and all its data. Frankfurt, Germany; Dublin, Ireland ISO 27001, 27017, 27018 certification and SOC2 Type I attestationIreland-
Heroku [Salesforce]Cloudplatform as a service (PaaS) to build, run and operate Drieam’s web applications.Europe ISO 27001, 27017, 27018 certification and SOC2 Type I attestationUS-
TransIP WebhostingNL ISO 27001 certificationNL Only applicable to Canvas hosting
AppsignalApplication performance monitoringNL Application data stored in ISO 27001 certificated facilitiesNL-
BugsnagReporting, monitoring and resolving issues in our softwareEU USPhase out in Q4 2020
NewRelicDigital Performance Monitoring and ManagementEU USPhase out in Q4 2020
MailgunTransaction email service to send, receive and track emailsEU USOnly applicable to Eduframe and Canvas hosting
UserpilotSoftware to support in-app onboardingUS-USOffered as an opt-in feature for our customers
InstructureLearning Management System (LMS) apllicable when reselling Canvas LMS
Qualtrics XMDistribution of surveys and saving and reporting of survey results.EUISO 27001 Certification applicable when reselling Qualtrics.
HubspotStore leads info, establish communication channels and track progress along the buying lifecycleEU & US Application data stored in ISO 27001 certificated facilities USThe data that is processed is limited to Drieam’s direct contact persons at the customer/lead
MoneybirdInvoicing & accounting softwareNL-NLOnly personal data of Drieam’s direct contact persons at the customer is being processed.
SlackUsed as internal communication system at Drieam. Although sharing personal data of our customers over is limited, a processing agreement with Slack has been concluded.US USOnly personal data of Drieam’s direct contact persons at the customer is being processed.
FreshdeskHelpdesk softwareUS & EU ISO 27001, 27017, 27018 certification and SOC2 Type I attestation USOnly personal data of Drieam’s direct contact persons at the customer is being processed.
Google SuiteUsed for email communication, calendar events and cloud storage of our team. US & EU Application data stored in ISO 27001 certificated facilities USOnly personal data of Drieam’s direct contact persons at the customer is being processed.


Feel free to contact our security officer for any question or comment related to Drieam’s (data) privacy & security:

For information concerning our external Data Protection Officer (DPO), please consult our Privacy Policy.

About Drieam

Drieam enables higher education, commercial training providers & business schools to deliver the ultimate learning experience with Canvas. We do this by leveraging the best software out there, including our own solutions. All seamlessly integrated.


Drieam BV

Don Boscostraat 4 (5th floor)
5611 KW Eindhoven, The Netherlands

Phone: +31 40 30 46 346



Copyright © Drieam 2020