Insights

Knowledge center

Articles on cybersecurity legislation, secure development and application security testing. Browse by category, or search by keyword or tag.

Filter by tag

10 articles

EU CRA

The EU Cyber Resilience Act: obligations, harmonised standards and how to prepare.

7 min read

The EU Cyber Resilience Act: an executive summary

What the CRA is, which products it covers, what manufacturers must prove and by when, and what non-compliance costs. Based on my BSides Krakow 2026 talk.

6 min read

CRA harmonised standards: who writes what (October 2026)

Where every harmonised standard under request M/606 for the EU CRA stands, by committee and product class, and what it means for your conformity route.

SSDLC

Building security into every phase of software development.

9 min read

ENISA's Secure by Design and Default Playbook: an overview

What ENISA's July 2026 playbook contains, how its 22 principles and release gates work, and how SMEs can use it for the CRA's secure by design rules.

SCA

Software composition analysis: open-source dependencies, SBOMs and supply chain risk.

Privacy Policy

Last updated: 18 October 2026

SecureHabits (KVK 78029260, VAT NL003278436B94, Willemspoort 102, Den Bosch, 5223WV Netherlands) is the controller for personal data processed through this website. We sell training and advisory services to companies; we do not sell personal data, build advertising profiles, or make automated decisions about you. Questions and requests: [email protected].

What we process, and why

  • Requests you send us. When you book a call, submit a quote request, use the chat, or email us, we receive the details you provide (name, work email, phone, company, your message). We use them to answer you and to prepare the engagement you asked about (legal basis: taking steps prior to a contract, or our legitimate interest in responding). Booking, forms, chat, and our CRM (Zoho CRM) run on Zoho, hosted in Zoho’s EU data centers, acting as our processor.
  • EU CRA Self Assessment. Your answers and scores stay in your browser (session storage, cleared when you close the tab), and the PDF report is created there too; we never receive them. When you click “Download the PDF”, we receive only the contact details you enter (name, company, role, work email) and store them in our CRM (Zoho CRM). We use them to follow up on your report, for example to offer to go through the results with you (legal basis: our legitimate interest in responding to a business inquiry). We do not add you to a newsletter or mailing list on this basis.
  • Technical logs. The site is static and served from Scaleway (Amsterdam, EU). Serving requests produces short-lived infrastructure logs (IP address, requested URL, user agent) used for security and operations (legitimate interest).
  • Analytics, only with consent. If you choose “Accept all” in the cookie banner, we load Google Tag Manager, Google Analytics 4, and Microsoft Clarity to understand how the site is used (pages visited, interactions; Clarity may record anonymized session replays). Nothing loads if you pick “Essential only”, and you can change your mind at any time via the cookie settings link in the footer (legal basis: consent). On the EU CRA Self Assessment page, analytics records only that the check was started, completed, and its report downloaded, never your answers or score, and Microsoft Clarity does not record session replays of that page.
  • Embedded videos. Videos are click-to-load through YouTube’s privacy-enhanced domain; YouTube sets cookies only after you press play.

Recipients and transfers

We share personal data only with the processors named above (Zoho, Scaleway, and, with your consent, Google and Microsoft). Zoho and Scaleway process in the EU. Google and Microsoft may transfer data to the United States; both certify under the EU–US Data Privacy Framework and use standard contractual clauses.

Retention

Inquiries and chat transcripts are kept while we are in contact and deleted when no longer needed. Contact details from the EU CRA Self Assessment are deleted 24 months after our last contact with you, unless they become part of an engagement. Records that become part of a contract (quotes, invoices) follow Dutch bookkeeping retention (seven years). Analytics data follows the vendors’ default retention (Google Analytics: 14 months).

Your rights

Under the GDPR you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest; where processing rests on consent you can withdraw it at any time without affecting earlier processing. Write to [email protected]; we respond within one month. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Terms of Service

Last updated: 21 August 2026

This website is operated by SecureHabits (KVK 78029260, VAT NL003278436B94, Willemspoort 102, Den Bosch, 5223WV Netherlands). By using the site you accept these terms.

The website

  • Content on this site describes our services and is provided for information; it is not advice for a specific situation and creates no engagement by itself. We may change content, prices, and availability at any time.
  • We take care to keep the information accurate but provide the site “as is”, without warranty. To the extent permitted by law, we are not liable for damage arising from use of the site or from temporary unavailability.
  • Site content (text, images, brochures) belongs to SecureHabits or its licensors. You may download and share our brochures unmodified; other reuse needs our written permission. Trademarks and logos of clients and partners remain theirs.

Services

Trainings, assessments, and advisory work are contracted separately: the quotation or order confirmation you receive from us, together with any engagement terms referenced there, governs that work. Prices on this site are indicative, exclusive of VAT, and valid as stated in the quotation. Where these website terms and an engagement document differ, the engagement document prevails.

Applicable law

Dutch law applies. Disputes that cannot be settled amicably go to the competent court in the district of Oost-Brabant, the Netherlands.

Questions about these terms: [email protected].

Cookie Policy

Last updated: 18 October 2026

This site works without tracking. Strictly necessary browser entries store your cookie choice, your language, and your EU CRA Self Assessment answers while you fill it in; everything else loads only after you choose “Accept all” in the banner, and you can change your choice any time: open cookie settings.

Strictly necessary

Name Set by Purpose Duration
sh-consent this site (localStorage) remembers your cookie choice until you clear it
sh-locale this site (localStorage) remembers your language choice until you clear it
sh-cra-check this site (sessionStorage) keeps your EU CRA Self Assessment answers while you fill it in until you close the tab

Analytics and chat, only after “Accept all”

Name Set by Purpose Duration
_ga, _ga_* Google Analytics 4 distinguishes visitors, measures site usage up to 2 years
_clck, _clsk, MUID Microsoft Clarity usage statistics and anonymized session replays up to 1 year
uesign, LS_CSRF_TOKEN, zsiq* Zoho SalesIQ runs the chat widget and keeps your conversation session to 1 year

Embedded content

YouTube videos load through youtube-nocookie.com and set cookies only after you press play. The Zoho booking calendar sets functional cookies inside its own frame when you use it to schedule a call.

Withdrawing consent stops these services from loading on your next page view; cookies already set can be removed in your browser settings. More detail on what the data is used for is in the privacy policy.