Trust Center

Swedish-owned. Data stored in Sweden. Certified security. Open standards. Here you will find information about how we protect data, meet regulatory requirements and build a platform trusted by organizations with the highest demands for security, compliance and control.

• How do you handle incidents?Incident managementNIS2

  We deliver services around the clock and therefore have troubleshooting and incident handling around the clock, year-round, with continuous monitoring of the platform and alarm reception. When an event is identified it is classified and prioritised based on severity and impact on the services, and it is escalated according to defined procedures to the right technical expertise. A serious problem can be escalated to a critical incident, which activates a dedicated crisis management team with a mandate to make rapid decisions. After a remediated incident, a root cause analysis is carried out to capture permanent improvements in the platform and our working methods.

• How are we informed during an ongoing incident?Incident management

  We keep customers informed via our status page during an ongoing problem. When a problem is resolved we send an incident report to affected customers on request. Our procedures include the incident reporting requirements in Cybersäkerhetslagen (NIS2).

• How quickly do you inform us of an incident or personal data breach?Incident managementNIS2GDPRDORA

  In the event of an incident affecting you, we inform you without undue delay, and at the latest within 24 hours of becoming aware, so that you have time to meet your own obligations. In the event of a significant incident, we follow Cybersäkerhetslagen (NIS2) in reporting to the competent authority (MCF): early warning within 24 hours, an incident report within 72 hours and a final report no later than one month after the incident report.

• Responsibility and procedures in the event of incidentsIncident management

  Management responsibility and procedures are established for a fast, effective and orderly response to privacy and information security incidents. The incident team works from predefined playbooks for, among other things, ransomware, DDoS and data breaches, and immutable logging secures evidence for forensics.

• How are security events and threats reported internally?Incident management

  Security events and suspected threats are reported through established internal channels as quickly as possible, so that they can be assessed and, where needed, escalated without delay. All employees and consultants have a responsibility to report, and the procedure is part of our security training.

• How do you report material events to authorities?Incident managementNIS2GDPRDORA

  Material events are reported according to applicable rules. Serious incidents covered by Cybersäkerhetslagen (NIS2) are reported to Myndigheten för Civilt Försvar (MCF), and for incidents concerning financial entities we deliver to, we follow DORA. In the event of a personal data breach, we as a data processor inform the affected data controller without undue delay under GDPR, so that they can fulfil their own notification obligation.

• Reporting of weaknessesIncident management

  Employees and consultants are to note and report observed or suspected weaknesses in systems or services, and there are established escalation paths for how the reports are handled.

• How do you assess whether an event is an incident?Incident management

  Reported security and privacy events are assessed in a structured way and classified according to defined criteria, including impact on confidentiality, integrity and availability (the CIA triad), how many systems or customers are affected, whether personal data is involved and whether the event may trigger a reporting obligation. Based on the assessment, a decision is made on whether the event should be handled as an incident and what severity it is assigned.

• Learning from incidentsIncident management

  After an incident we conduct a thorough review (retro) and capture lessons that we share internally and translate into improved procedures and controls. How thorough the review is depends on the scope of the incident, and incident reports are shared with customers who request them.