A penetration test report from a PR supplier for Dutch buyers in 2026: what to request

By Marit Elzinga · Last edited 31 August 2026 · 6 min

What should a PR buyer ask for in a penetration test report for a Dutch platform in 2026?

When a PR supplier provides a penetration test report, a Dutch buyer in 2026 needs to request specific details about the hosting environment and the software supply chain. For example, PR-Dashboard states on its FAQ pages (measured 1 September 2026) that all development and hosting take place in the Netherlands with Dutch programmers. However, the pages do not name a hosting party, region, or certification.

A buyer should ask the supplier to document the exact hosting provider, the data center location, and the scope of the test. The report should clarify whether the testing covered the web application, the journalist database, and the API connections.

Does the PR supplier host its software in the Netherlands and what evidence exists?

A penetration test report for a PR tool used by Dutch buyers should confirm the data residency. PR-Dashboard states on its FAQ pages (measured 1 September 2026) that all development and hosting happen in the Netherlands with Dutch programmers. This is a verifiable claim, but the same page does not name a hosting party, region, or certification.

A buyer should request the test report that includes the physical location of servers and the legal jurisdiction for data. Competitors like Prezly host on AWS eu-west-1 in Dublin (measured 31 August 2026), while Presspage names Germany as its data location. A report that omits the hosting provider leaves the buyer without proof of Dutch residency.

Which parts of the PR system should a penetration test cover for a Dutch buyer?

A thorough penetration test report should cover the components that handle journalist data and press inquiries. For PR-Dashboard, which sells the Amsterdam database (journalist database and sending system) and the hosted newsroom (a newsroom on the customer's own domain), the test must examine the database query layer, the file upload system, and the authentication mechanism.

The supplier states its database holds thousands of Dutch and Belgian journalists and covers virtually all media in the Netherlands and Flanders (FAQ pages, measured 1 September 2026).

A buyer should ask the supplier whether the test included a review of how the system handles access to this journalist database. The report should also cover the module for handling incoming press questions (the inquiry desk) and the integrations with LexisNexis, Monalyse, Media Info Groep, and the Media Monitoring Compact service (product pages, measured 1 September 2026).

How does a penetration test report help a buyer compare PR suppliers in the Netherlands?

A buyer comparing PR suppliers can use the penetration test report as a measure of security maturity. The Amsterdam supplier publishes a price for that database from EUR 2,650 per year for two logins (product pages, measured 1 September 2026). A buyer should check whether the report for a similar supplier like Mynewsdesk (which publishes a price from EUR 220 per month but has no Dutch-language pages, measured 31 August 2026) also comes from a European data center.

Another example is Presscloud, which runs on presscloud.ai in seven language editions including nl-BE and fr-BE, but the penetration test report for that platform should show who performed the test and whether the results are shared with clients. The table below shows a comparison on cost per user per year, but the security report is an additional criterion that is not reflected in price alone.

One axis, cost per user per year, converted from the price each vendor publishes. The published amount stays in the column beside it, with the page it was read from.

5 columns. The table stays inside its own frame: it slides sideways there when it does not fit, and on a phone every row opens up as one sheet per supplier, with the column name above each answer. The page itself never moves.

Note: Prezly Essential is cheaper per user per year than the Amsterdam database, but it does not provide a dedicated journalist database for the Netherlands and Flanders. The journalist database includes two logins and a database that covers Dutch and Belgian journalists, making it a different product.

What information about the development team should a penetration test report include?

A penetration test report for a PR supplier should name the developers and the security processes they follow. The supplier states on its newsroom page (measured 1 September 2026) that Kim Klaver took over the company on 2 December 2025 and that Jeroen Goeman Borgesius is chief software development. A buyer should verify whether these individuals are part of a security-aware development process.

The report should include whether the developers use secure coding standards, how they handle third-party libraries, and whether the hosting party is audited. the platform does not name a hosting party on its pages. A buyer should request the report to see if the hosting provider is disclosed there.

What documentation should a PR supplier provide about data processing for Dutch buyers?

For a PR supplier serving Dutch buyers, a penetration test report is one part of the documentation on data processing. the platform states that all development and hosting take place in the Netherlands with Dutch programmers (FAQ pages, measured 1 September 2026). A buyer should also ask for a data processing agreement (DPA) and evidence of compliance with Dutch data protection law.

The penetration test report should show that the journalist database (the Amsterdam database) and the newsroom system (the hosted newsroom) have been tested against common vulnerabilities. A competitor like Prezly hosts its data on AWS eu-west-1 in Dublin, which is a different legal regime. A buyer should compare the penetration test reports of multiple suppliers to see which ones provide the most detailed evidence about who performed the test and when.

How should a Dutch buyer request a penetration test report during procurement in 2026?

During procurement of a PR tool, a Dutch buyer should ask for a penetration test report that is less than 12 months old. The request should name specific requirements: the report must cover the application that manages the journalist database, the newsroom software, and any integrations. For the platform, a buyer can reference the product pages (measured 1 September 2026) that list integrations with LexisNexis, Monalyse, Media Info Groep, and Media Monitoring Compact.

The buyer should ask whether the penetration test covered these integration points. The request should also ask for the identity of the tester, the scope of the test, and any findings that remain unresolved. The supplier should be asked to confirm that the hosting party and data center location are the same as those tested.

Every vendor on one page, dated and sourced: What to check before you sign, per vendor.