Dutch startups working on security and privacy in 2026

More than 87 Dutch startups describe security or privacy as the core of their mission. They operate across a wide range of sectors: from fintech and healthcare to deeptech and legal software. What connects them is their use of technology to reduce risk, protect data or automate oversight, often in areas where traditional methods are too slow or too costly.

These companies are based in cities such as Amsterdam, Utrecht, Eindhoven and Heerlen. Some target end users directly, while others supply infrastructure to established players in insurance, security or healthcare. Together, they illustrate how broadly the concept of 'security' is interpreted within the Dutch startup scene.

Biometrics without surveillance

20face (Enschede, founded 2017) builds facial recognition software for access control that works without a badge or PIN code. The technology converts a face into an encrypted vector that cannot be traced back to the original image. Users can withdraw their consent at any time. The company develops its algorithms entirely in-house, deliberately avoiding the software supply chains of Chinese or American providers.

The software complies with the GDPR and is, according to the company, unsuitable for blacklisting or surveillance. Clients include logistics service provider Secure Logistics, care organisations Sensire and Amstelring, and the World Port Centre Rotterdam. Integrations are handled through partners such as Nedap and Salto.

In August 2024, 20face raised over €1.3 million from Value Creation Capital, Oost NL and newcomer Twinning Participaties. In August 2026, a further investment followed from 819 Capital Partners via the 819 Evergreen Fund, aimed at commercialisation and market expansion. The exact amount was not disclosed. The mandatory rollout of the European Digital Identity Wallet (EUDI Wallet) at the end of 2026 presents the company with opportunities in identity verification and digital access applications.

Drones as guardians of large sites

LUGN Security (Heerlen, founded 2021) deploys drones as mobile guards for large industrial sites and infrastructure. From a 24/7 Drone Control Centre, operators remotely manage the aircraft. The system combines direct visual verification with structured incident follow-up, enabling faster intervention than traditional patrol rounds.

The company holds a BVLOS operating permit (flying beyond the visual line of sight of the pilot) for complex industrial environments. LUGN has carried out pilots with NS, industrial partners and the Dutch Ministry of Defence. In October 2025, it entered into a strategic partnership with control room operator Intergarde in Maastricht. In early 2024, LIOF joined as a financier through the Seed Fund Limburg.

Co-owners are Alex Hermans, previously active at security firm Nimo Dog Security, and Dirk Bekke, a former robotics lecturer at Saxion. The name LUGN stands for Layered Unified Guard Network, reflecting the layered design of the system.

Fraud detection and compliance in finance

FRISS (Utrecht, founded 2006) automates fraud detection for non-life insurers. The platform analyses claims and policies for risk signals, enabling insurers to assess more quickly and consistently where further investigation is needed. FRISS is active with insurers worldwide and raised €59.4 million in a Series B round in 2024.

Clember (Utrecht, founded 2023) focuses on cybersecurity analyses for consultants and aims to reduce turnaround time from weeks to minutes. Concrete funding details from independent sources are not yet available; the acquisition dates listed in the database are internally inconsistent.

Securly (Eindhoven, founded 2019) secures web applications using AI and monitors compliance in real time. Here too, the funding data available from existing sources cannot be fully verified.

Privacy in healthcare and document processing

iseeubabycare (Utrecht, founded 2024) is developing an AI camera system that objectively monitors the sleep of premature babies without requiring a nurse to be continuously present. The system processes sensitive medical image data, raising privacy questions around storage and access. In 2025, the company raised €27 million in a Venture Round.

Doxray (Neede, founded 2014) automates document processing and data extraction for European organisations. Automated document processing directly touches on issues of data governance and GDPR compliance, although detailed funding information from independent sources is limited for this company.

Castor EDC (Amsterdam, founded 2012) provides a platform for clinical studies, with patient data at its centre. The company raised €59.8 million in a Series B round in 2021 and serves research institutions operating under strict medical data regulations.

What these companies have in common

The startups in this overview differ considerably in sector and approach, but share a number of characteristics. First, they operate in heavily regulated sectors: healthcare, finance, physical security and legal compliance. This makes GDPR conformity and auditability not a side consideration, but a prerequisite for serving customers at all.

Second, several companies deliberately position European technology development as a selling point to clients. 20face explicitly emphasises that it does not use algorithms from the US or China. This positioning responds to growing concerns among governments and businesses about the origin of sensitive software.

Third, many of these startups do not sell directly to consumers, but to established players: insurers, hospitals, security firms and research institutions. They enhance the ability of those parties to manage risk, without fully replacing the existing chain.

For the broader Dutch and European AI scene, this cluster is relevant. The forthcoming EUDI Wallet, the AI Act and the tightening of the NIS2 directive are creating a regulatory framework that several of these startups are directly responding to. This presents opportunities for companies that invested early in compliance-friendly architectures, while simultaneously raising the barrier for newcomers who must retrofit this capability after the fact.