This customer story shows how Het Kandidatennetwerk shares sensitive documents securely with Msafe. The foundation supports young people and collaborates with staff, programme partners and grant providers. This work involves personal data, evaluations, progress information and project documents. Msafe Secure File Transfer brings these exchanges into a controlled process with encryption, targeted access, malware scanning and an audit trail. These controls support secure working and GDPR accountability, but do not replace lawful grounds, policy, retention rules or human oversight.
Kandidatennetwerk customer story: at a glance
Het Kandidatennetwerk develops programmes that strengthen the economic and social self-reliance of young people. Its work supports talent development, employment, financial capability and participation in society. One area of activity is Maatschappelijke Diensttijd (MDT), a Dutch programme through which young people develop their talents, meet others and contribute to society.
The organisation is people-centred, but the information processes behind its programmes require operational discipline. Staff and partners may handle documents describing a young person’s personal circumstances, development or progress. Project, partnership and grant documentation is exchanged as well. Not every file has the same risk profile, but sensitive information requires clarity about who receives access, how long access remains valid and which actions can later be reconstructed.
The challenge: sharing sensitive documents with young people and partners
The original customer story identifies three document flows that require particular care:
- personal data relating to young people participating in programmes such as MDT;
- evaluations and progress reports containing personal or sensitive information;
- collaboration documents shared with external partners and grant providers.
The requirement therefore went beyond encrypting files. The foundation needed a way of working that combined protection, control and usability. A technically strong process that is too difficult in practice encourages workarounds. An easy process without access governance and logging leaves too little evidence.
What did the organisation require from the solution?
Five selection criteria can be inferred from the existing story. The solution needed to protect sensitive documents, target access to intended recipients, screen files for malware, record activities and remain usable for staff and external partners. This combination is particularly relevant for social-impact organisations: privacy protection works only when people consistently use the approved process.
The essence of the decision
The organisation did not need one isolated security feature. It needed one workable process covering transfer, access and evidence, making secure sharing part of everyday work rather than an exception beside email and unmanaged links.
The selected solution: Msafe Secure File Transfer
After evaluating different options, Het Kandidatennetwerk selected Msafe Secure File Transfer. The foundation can use a managed transfer layer while senders and administrators retain control over recipients, access and the available audit information.
Targeted access for staff and external recipients
Files are made available to the intended recipient rather than distributed as unmanaged attachments. Depending on policy, the organisation can use additional verification, time-limited availability or revocable access. The question “who should receive this document?” remains part of the sharing workflow.
Protection during transfer
Danny Della Chiesa identifies encryption and virus and malware controls as important capabilities. These measures reduce relevant risks, but do not make an organisation immune to incidents. Incorrect classification, the wrong recipient or unsuitable policy still require human and organisational controls.
Audit trails and reconstruction
Msafe records activity within the product scope. This allows the organisation to investigate who shared a file, which recipient received access and which action occurred at which time. That information supports internal control, partner questions and GDPR accountability.
Usability in everyday work
Staff and partners need to upload, share and retrieve documents without commissioning a technical connection for every recipient. The value therefore lies not only in security, but also in making the approved route more attractive than a faster workaround.
Turning product capabilities into demonstrable control
A capability becomes a control only when the risk, owner and retained evidence are clear. For this customer story, that translation can be expressed as follows:
| Control question | Use in the story | Demonstrable record |
| Who receives access? | Targeted access for staff and external recipients. | Recipient, access status and validity period. |
| How is the file protected? | Encrypted transfer and malware controls. | Protected transfer and scan result within the product scope. |
| What happened? | Logging of sharing, opening, downloading and administrative actions. | Audit trail recording actor, action and time. |
| Can people use the process? | A recognisable workflow for staff and partners. | Usage, exceptions and support requests as adoption signals. |
The audit trail is not an end in itself. The organisation must decide who reviews logs, how long records are retained and what happens when an exception is found. Without those agreements, logging is information; with ownership and follow-up, it becomes useful evidence.
What changed for Het Kandidatennetwerk?
Danny Della Chiesa describes qualitative improvement: staff can use a recognisable channel for sensitive information, external collaboration gains targeted access and activities can be reconstructed more readily. Because the original story contains no baseline or usage metrics, the outcome is deliberately not presented as a percentage or guaranteed reduction in risk.
| Previously: control question | With a central sharing process |
| How do we exchange sensitive documents externally without fragmented channels? | One approved route for transfer, access and expiry. |
| Can we reconstruct who performed which action? | Audit information records recipients, actions and time. |
| How do we keep the process usable for staff and partners? | A recognisable workflow without technical setup for each recipient. |
| Does this prove full GDPR compliance? | No. It supports security and accountability; policy and correct use remain necessary. |
The customer’s experience
“With Msafe, we can finally work with external parties without unnecessary concern.”
Danny Della Chiesa responsable for IT and Quality.
The significance of this statement is not an absolute guarantee. It is the confidence to act: staff have a clear channel for external collaboration and know which route is intended for sensitive information.
What other non-profits can learn from this story
- Start with document flows, not features. Map which personal data, reports and partner documents leave the organisation.
- Define the recipient and validity period for each flow. Not every partner needs the same access or availability.
- Make the secure route easier than the workaround. Adoption is part of information security.
- Define the evidence requirement. Decide which actions must be reconstructed during a question, audit or incident.
- Review exceptions periodically. Local downloads, email attachments and partner-specific processes require explicit attention.
Does Msafe support GDPR compliance?
Msafe supports appropriate security and accountability with capabilities for encryption, access, retention and logging. The compliance requires more than a technical platform. The organisation remains responsible for lawful grounds, transparency, data minimisation, retention, data-subject rights, supplier agreements and correct use.
More customer cases: read how NS shares confidential and large files and how VvAA shares files securely and easily. Also read about the GDPR and secure file sharing and why emailing sensitive documents creates risks.
Frequently asked questions about secure document exchange for non-profits
Secure sharing in the social sector
An attachment is copied into the recipient’s mailbox after delivery. Central revocation, enforced expiry and reconstruction of activity are generally limited.
Examples include identifying personal data, progress and evaluation information, details about debt or support, and documents that reveal a young person’s personal circumstances.
Security, GDPR and partners
No. It can reduce risk through targeted access, encryption, expiry and logging. Incorrect decisions, unsuitable policy or misuse can never be eliminated entirely through technology.
Yes. An audit trail can support accountability and incident reconstruction. The organisation must still define which logs matter, who reviews them and how long they are retained.
Yes. Msafe is designed for human-centred document exchange. Recipients can receive controlled access without requiring a system integration for each exchange.
Useful measures include active users, external partners, approved sharing flows, support requests, handling time, revoked access and time required to reconstruct a transfer.
Conclusion: secure collaboration starts with a usable process
Het Kandidatennetwerk shows that secure document exchange in the social-impact sector is not merely a technical question. Personal data, project information and partner documents require protection, while staff and external participants still need a practical way to collaborate. Msafe brings transfer, access and evidence into one managed process.
To assess how your organisation exchanges sensitive documents with participants, partners or grant providers, bring one real document flow to a demonstration or Proof of Concept. Test not only whether the file arrives, but also how access, expiry, logging and follow-up align with policy.
