Elastx Information Security Policy

Elastx AB is a Swedish Cloud Provider certified according to ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27018. We are committed to maintaining and continuously improving an Information Security Management System (ISMS) that protects our customers' information, supports our business objectives, and meets applicable legal, regulatory, and contractual requirements.

1. Purpose and scope

This policy defines the purpose, direction, and basic principles for information security management at Elastx. It applies to all employees, contractors, suppliers, and other parties who process information on behalf of Elastx.

Our strategy is to provide a sovereign cloud platform operated from Sweden for European business-critical services and sensitive data. Information security is at the core of our operations to address stringent compliance needs within the public sector, healthcare, and financial services.

This document is the public version of our Information Security Policy and may be shared with external parties. Operational procedures, detailed control requirements, and supporting evidence are documented internally and available to authorized parties on request.

2. Security principles

Information security at Elastx is based on the following principles:

Confidentiality: Information is accessible only to authorized persons and systems.
Integrity: Information is accurate, complete, and protected from unauthorized modification.
Availability: Information and services are accessible when needed.
Proportionality: Security measures are aligned with the value and risk of the information.
Continuous improvement: The ISMS is regularly reviewed, tested, and improved.
Shared responsibility: Elastx, our customers, and our suppliers each have clearly defined security responsibilities.

3. Governance and responsibilities

The Management Team is accountable for the ISMS and ensures that it is adequately resourced.

Operational coordination and responsibility for our compliance are delegated to our Cybersecurity Compliance Officer, who manages, measures, and follows up on the ISMS, risk management, and our security objectives. Technical security controls and objectives are initiated by our engineering teams, with final approval by technical management.

Management reviews of the ISMS, including security objectives and risks, are held at least annually. Objectives are reviewed at least annually and adjusted to align with business objectives, changes in risk, and applicable requirements.

4. Objectives and measurement

Elastx is committed to continuously improving the ISMS and minimizing the impact of security incidents. Progress is measured through:

Providing affected customers with incident reports describing the incident, root cause, and actions taken.
Conducting risk analyses and producing risk treatment reports at least every six months.
Maintaining documented capacity planning for the cloud platform.
Testing business continuity and disaster recovery plans at planned intervals.
Auditing suppliers and internal processes according to a risk-based audit plan.
Handling nonconformities through a corrective action process and following them to closure.

5. Legal, regulatory and contractual requirements

The ISMS is designed to meet the legal, regulatory, and contractual requirements that apply to Elastx directly or through our commitments to customers, including but not limited to:

General Data Protection Regulation (GDPR)
Cybersäkerhetslagen, the Swedish implementation of the NIS2 Directive
Digital Operational Resilience Act (DORA), applicable to Elastx as an ICT third-party service provider to financial entities
EU Artificial Intelligence Act (AI Act)

A detailed list of legal, regulatory, and contractual obligations is maintained internally and reviewed regularly.

6. Security controls

Elastx selects, implements, and maintains security controls based on risk assessments, ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, and customer-specific requirements. Control areas include:

Access control and identity management: Utilizing principles of least privilege and strict segregation of duties between platform operations and application development, enforced by policy-as-code and automated Role-Based Access Controls (RBAC).
Information classification: Information is classified according to defined categories, and protective measures are selected based on classification.
Encryption: Data in transit and at rest is encrypted, with keys managed through approved KMS/HSM services.
Network security: Segmentation and strict access rules are enforced.
Threat intelligence: We monitor threats and apply protective measures based on threat intelligence.
Vulnerability and patch management: Vulnerabilities are identified, assessed, and remediated according to defined timeframes.
Logging and incident detection: Active monitoring of security events.
Secure development: Following secure coding practices, code review, and automated vulnerability scanning in CI/CD pipelines.
Business continuity: Backup and disaster recovery routines are tested at planned intervals.
Physical security: Protection of data centers and secure zones.

7. Incident management and business continuity

Security incidents are managed through a documented critical incident process that includes detection, escalation, containment, eradication, recovery, and communication. Reporting to competent authorities and affected customers is performed in accordance with legal requirements and contractual obligations.

Business continuity and disaster recovery plans are documented, tested, and reviewed at planned intervals to ensure the uninterrupted delivery of services.

8. Supplier and third-party management

Suppliers and partners with access to Elastx information or services are assessed, contracted, and monitored in accordance with our supplier risk management process. Supplier relationships are governed by confidentiality, security, and data processing requirements. Critical suppliers are subject to due diligence and periodic review.

9. Artificial intelligence

The use and development of AI at Elastx is governed by our AI Ethics and AI Governance Policy. AI systems are classified, risk-assessed, and subject to human review where required. We do not allow AI-generated changes to be deployed without appropriate review and approval.

10. Awareness, training and compliance

All personnel are required to comply with this policy, the Acceptance Use Policy for Elastx systems and information, and related security procedures. Security awareness training is provided during onboarding and regularly thereafter, and roles with elevated privileges receive additional training.

Compliance with this policy and the ISMS is monitored through internal audits, management reviews, vulnerability assessments, penetration tests, and other assurance activities. Nonconformities are handled through a corrective action process.

11. Policy review

This policy is reviewed at least annually and whenever significant changes occur in the business, risk landscape, or applicable requirements. The current version is published on elastx.se/en/information-security.

Version date: September 21, 2026

Elastx Management System Certificate (ISO/IEC 27001:2022) - Valid until December 9, 2027 (Certificate No: 0095098 by Intertek)

Elastx is also certified as a service provider according to ISO 14001.

A complete audit report is available upon request.