Trust Center

Swedish-owned. Data stored in Sweden. Certified security. Open standards. Here you will find information about how we protect data, meet regulatory requirements and build a platform trusted by organizations with the highest demands for security, compliance and control.

• How do remote work and access to the production environment work?Access & authorization#

  All access to the production environment goes through secured paths and requires multi-factor authentication. There are three ways in: a Corporate Proxy, which is the general path for daily access for most employees; a VPN path for maintenance that requires access to multiple systems or to systems not reachable via the proxy; and a separate out-of-band VPN (OOB VPN) used during disaster recovery. Information handled and stored during remote work is additionally protected by policy and technical security measures.

• Restriction of software installationAccess & authorization#

  Rules for which software users may install are established and enforced, so that only approved and secure software runs in the environment and the risk of malicious or insecure code is reduced.

• Responsibility upon terminated or changed employmentAccess & authorization#

  Information security responsibilities that apply after terminated or changed employment are defined, communicated and enforced. This includes, among other things, that confidentiality and non-disclosure undertakings remain in force, that assets are returned and that access is revoked, so that the protection of information is maintained even after the role has changed or ended.

• How are user permissions granted and revoked?Access & authorization#

  We have a formal process for the entire lifecycle of user accounts. When a person joins, the account is registered and granted the permissions the role requires according to the principle of least privilege. Upon a change of role the permissions are adjusted, and when an employment or contract ends the account is deregistered and access is revoked immediately, including SSH keys and VPN credentials, while confidentiality undertakings remain. The process covers all user types and all systems and services, and permissions are reviewed regularly.

• How do you handle privileged (administrative) permissions?Access & authorization#

  Privileged access rights, that is, elevated administrative permissions, are handled more strictly than ordinary user access. They are granted restrictively and only to named, personal accounts, limited to what the role requires and followed up specifically. Administrative access to the production environment always requires multi-factor authentication.

• How is secret authentication information (for example passwords and keys) handled?Access & authorization#

  The assignment and handling of secret authentication information, such as passwords, API keys and certificates, is governed by a formal process. Such information is distributed securely, stored protected and rotated when needed, and secrets are never stored in plaintext in source code. We use a password management system that maintains good password quality.

• What is expected of users regarding secret authentication information?Access & authorization#

  Users follow the organization's procedures for protecting passwords and other secret authentication information, including not sharing login credentials and handling them securely.

• Is the environment monitored around the clock?Logging & monitoringNIS2#

  Yes. We monitor the platform's operation and network traffic around the clock, year-round (24/7/365), with automatic alerts going directly to our engineers. The real-time monitoring tracks platform health, security metrics and network traffic and alerts on anomalies, and central dashboards watch for, among other things, unauthorized access attempts and abnormal traffic patterns. Operational and security logs are collected centrally, and we work continuously to strengthen our ability to detect security events.

• Is privileged access to the infrastructure logged?Logging & monitoring#

  Yes. We keep audit logs for all infrastructure, which includes logins and privileged access to underlying systems. The logs are collected centrally and retained for an extended period, and relevant extracts can be provided on request - for example in connection with a security or personal data incident.

• How do you detect capacity shortages before they affect the service?Logging & monitoring#

  We monitor capacity continuously and have automatic thresholds in the data centers for, among other things, disk, CPU, memory (RAM) and graphics cards (GPU) that create a ticket when exceeded, so that capacity shortages can be addressed in time.

• Can we access our own logs and monitor the service?Logging & monitoring#

  Yes. You can access logs for your own services and make endpoints available for monitoring with the tool of your choice. Access is limited to log data relating to your own services.

• How long is monitoring data retained?Logging & monitoring#

  Metrics from the platform's monitoring are retained for at least 90 days. Audit logs are retained for an extended period, and relevant extracts can be provided on request.

• Capacity managementLogging & monitoring#

  Resource usage is monitored continuously and reviewed at set intervals, and future capacity needs are planned for to maintain the required performance.

• Event loggingLogging & monitoring#

  Logs of user activities, errors and security events are created, retained and reviewed regularly.

• Protection of log informationLogging & monitoring#

  Logging facilities and log information are protected against tampering and unauthorized access. Logs are collected centrally and tamper-resistantly, sent in real time to access-controlled archives and retained as forensic evidence.

• Clock synchronizationLogging & monitoring#

  The clocks in all relevant systems are synchronized to a common, traceable reference time source. We synchronize to ntp.se, the Swedish standard time service operated by RISE and Netnod, which makes logs comparable across systems and enables accurate forensics.

• How do you work with vulnerabilities and patching?Vulnerability management & patchingNIS2#

  We have a central process and policy for vulnerability management. We carry out regular vulnerability scanning, rank vulnerabilities by risk and track them to remediation according to defined service levels (SLA). Container images are also scanned automatically in the build pipeline, and patching is carried out regularly with priority on high-risk systems.

• How do you harden the systems?Vulnerability management & patchingNIS2#

  We harden physical and logical components (for example servers, virtual machines and service protocols) according to established hardening standards (including CIS Benchmarks), and the configuration is managed as code so that a secure baseline is maintained.

• How do I report a vulnerability to you?Vulnerability management & patchingNIS2#

  We have an established process for responsible vulnerability disclosure. If you or a security researcher discovers a vulnerability, it can be reported confidentially to compliance@elastx.se. We receive, assess and remediate reported vulnerabilities according to our vulnerability and patch management process.

• How do you protect against malicious code?Vulnerability management & patchingNIS2#

  We have multi-layered protection against malicious code at the hypervisor, orchestration and endpoint levels. All company devices have endpoint-level security monitoring (EDR), and in selected environments intrusion detection continuously monitors container runtimes. The protection is combined with recurring security training and awareness among staff.