Trust Center

Swedish-owned. Data stored in Sweden. Certified security. Open standards. Here you will find information about how we protect data, meet regulatory requirements and build a platform trusted by organizations with the highest demands for security, compliance and control.

• Do your staff have access to our data?Data protection & encryptionGDPR#

  No, not in day-to-day operations. Our staff work on the underlying platform without visibility into your data content, and do not have access to your instances or applications. Access to your environment takes place only if you explicitly request and approve it, for example in a support ticket, and is then limited to the specific need. All privileged access to the infrastructure uses personal accounts, requires multi-factor authentication and is logged.

• What role does Elastx have under GDPR?Data protection & encryptionGDPRDigital sovereignty#

  Our role depends on the personal data processing in question. For your customer data and workloads on the platform, we act as a data processor, and we guarantee technical and organizational protective measures under signed Data Processing Agreements (DPA) in accordance with GDPR. For administrative data relating to our own customer relationship with you, for example contact details and login logs for your contract administration, we act as a data controller. For GDPR matters you can reach us at gdpr@elastx.se.

• Is data encrypted at rest?Data protection & encryptionNIS2GDPR#

  Yes. We have a policy and procedures for encryption, and all disks in our environment are encrypted with strong encryption (AES-256). Physical servers use self-encrypting drives (SED) according to TCG Opal with pre-boot authentication, so that a physically stolen storage medium does not grant access to data.

• How is data protected in transit?Data protection & encryptionNIS2GDPR#

  Data in transit is protected with TLS (versions 1.2 and 1.3) using strong encryption (AES-256) and with SSH key pairs. For managed database services, CA certificates are provided so that you can verify and encrypt your client connections.

• How are encryption keys managed?Data protection & encryptionNIS2GDPR#

  The encryption keys are protected by pre-boot authentication with a unique key per server, derived from the server's unique hardware, and are unlocked only at startup.

• Where is our data stored?Data protection & encryptionGDPRDigital sovereignty#

  As a data processor and an ISO/IEC 27018-certified company, we store data within Sweden. This means the information is kept within the EU/EEA and out of reach of foreign legislation such as the CLOUD Act. Personal data is processed only on a lawful basis and is securely erased when it is no longer needed.

• How do you avoid vendor lock-in?Data protection & encryptionDORADigital sovereignty#

  We build on open standards and open source (including OpenStack and Kubernetes) so that you can move your applications if you want. We apply no mandatory lock-in periods, and you pay for the resources you allocate. As a Swedish company we operate under Swedish and European jurisdiction and are not subject to third-country legislation, and we comply with the EU Data Act to counteract lock-in effects.

• Do you sell or share our data, or use it for marketing?Data protection & encryptionGDPR#

  No. Personal data entrusted to us is not sold and is not shared with third parties for marketing or advertising purposes without explicit consent. Your data is processed only to deliver the service under the contract and our Data Processing Agreement (DPA).

• How do you handle requests to disclose data, for example from authorities?Data protection & encryptionGDPRDigital sovereignty#

  We do not disclose data to parties outside our delivery other than following a legally binding request. Each such disclosure is documented (what was disclosed, by whom, to whom, when and on what legal basis), and where the law permits we inform the affected customer. As a Swedish company we operate under Swedish and European jurisdiction and are not subject to third-country legislation, neither the US CLOUD Act and FISA nor equivalent legislation in other countries. Your data is therefore not subject to foreign compelled disclosure. Furthermore, under GDPR Article 48, a judgment or an authority decision from a third country may not be recognized as grounds for disclosing personal data except on the basis of an international agreement.

• Do you use sub-processors?Data protection & encryptionGDPR#

  It is uncommon for us to use sub-processors. Your data on the platform is stored in Sweden and processed by us as a processor. For certain support services, for example invoicing and dispatch, we may use sub-processors, and the processing is then governed by a Data Processing Agreement (DPA) under GDPR Article 28. We verify that sub-processor agreements are in place, and we notify you before we add or change a data center or sub-processor. Any access for subcontractors to your data on the platform takes place only after your approval.

• What happens to our data when the contract ends?Data protection & encryptionGDPRDigital sovereignty#

  You can export your data ahead of a termination. Upon decommissioning of a service or virtual machine, or upon written request, your data and associated infrastructure are securely erased. Storage rests on self-encrypting drives, which enables cryptographic erasure in line with recognized standards for data sanitization. Logs linked to the processing of personal data are thereafter retained only for as long as the Data Processing Agreement (DPA) and applicable legal requirements demand.

• How do you help us with data subjects' rights?Data protection & encryptionGDPR#

  As a data processor, we assist you as the data controller in responding to requests from data subjects - for example access, rectification, erasure, restriction and data portability - in accordance with the Data Processing Agreement (DPA). The platform gives you technical means to find, export and erase personal data in your own environments.

• Which technical and organisational measures do you apply to protect personal data?Data protection & encryptionGDPR#

  Our Data Processing Agreement (DPA) specifies the technical and organizational measures we apply. Organizationally, we work according to ISO/IEC 27001 with role-based access, mandatory onboarding and offboarding procedures and personal confidentiality undertakings for all staff. Technically, data is encrypted at rest with AES-256 and in transit with TLS 1.2 and 1.3, and the infrastructure is continuously monitored with vulnerability scanning, DDoS protection and central tamper-resistant logging. More detail is available under the respective topic in the FAQ.

• How do you ensure that the Data Processing Agreements (DPA) are up to date?Data protection & encryptionGDPR#

  Our Data Processing Agreement and associated instructions are kept under continuous version control. Revisions prompted by changed legislation, new regulatory requirements or updated security measures are documented in a change history, so that you can always see what applies and why it was changed.

• What does your responsibility as a data processor cover?Data protection & encryptionGDPR#

  As a data processor, we process personal data solely according to your written instructions and without insight into the actual data content. We are responsible for the security, availability and resilience of the underlying cloud infrastructure, including physical security in the data centers, vulnerability protection at the platform level and support around the clock. You are responsible for your application, your credentials and the configuration of your own backups. A full allocation of responsibility is available in the Data Processing Agreement and in our cloud security policy (ISO/IEC 27017).