Trust Center

Swedish-owned. Data stored in Sweden. Certified security. Open standards. Here you will find information about how we protect data, meet regulatory requirements and build a platform trusted by organizations with the highest demands for security, compliance and control.

• Are you covered by Cybersäkerhetslagen (NIS2)?Regulatory complianceNIS2#

  Yes. We are covered by Cybersäkerhetslagen (the Swedish Cybersecurity Act, 2025:1506), which implements the NIS2 Directive and entered into force on 15 January 2026. We are covered as a provider of essential and critical infrastructure, partly through the transposition of the CER Directive, and as a provider of cloud services, data center services and CDN. PTS (the Swedish Post and Telecom Authority) is the supervisory authority for digital infrastructure, and Myndigheten för Civilt Försvar (MCF, the Swedish Civil Defence Agency) is the national coordinating authority and recipient of incident reports. We meet the law's requirements regarding security measures, management responsibility, training and incident reporting. Oversight of subcontractors and the supply chain is a central part of the requirements.

• Can you enter into security protection agreements (SUA)?Regulatory compliance#

  For security-sensitive customers, for example in the public sector, we can where needed enter into a säkerhetsskyddsavtal (SUA, a Security Protection Agreement) under säkerhetsskyddslagen (the Swedish Protective Security Act, 2018:585). Such an agreement is notified to Säkerhetspolisen (the Swedish Security Service).

• Compliance processRegulatory compliance#

  We have an organization and monitoring in place to stay in control of new or amended regulations, laws and standards relevant to the services. We maintain a legal register that tracks compliance requirements, including GDPR, Swedish security laws, NIS2, DORA and contractual requirements, and we keep our procedures and controls updated against it.

• How do you maintain contact with authorities?Regulatory compliance#

  We have documented and maintained contact channels to the authorities relevant to our operations, including PTS as supervisory authority and Myndigheten för Civilt Försvar (MCF) as recipient of incident reports. These contacts allow us to quickly report incidents, receive guidance and stay updated on changing requirements.

• Do you meet accessibility requirements (WCAG and EN 301 549)?Regulatory compliance#

  We follow the accessibility requirements under the EU Accessibility Directive (in Sweden, lagen om vissa produkters och tjänsters tillgänglighet, 2023:254) for those of our digital interfaces that are in scope, primarily our public websites and self-service interfaces. We work toward the guidelines in WCAG and the European standard EN 301 549.

• ICT risk managementRegulatory complianceDORA#

  We ensure and maintain an adequate level of digital operational resilience, and risks within information and communication technology (ICT) are managed within our risk management process.

• How do you report serious ICT incidents?Regulatory complianceNIS2DORA#

  We have a documented, communicated and tested process for reporting serious ICT incidents and cyber threats to customers and competent authorities. Reporting follows applicable rules, including Cybersäkerhetslagen (which implements NIS2) and, for incidents affecting financial entities we deliver to, DORA. For a significant incident we apply the NIS2 model: early warning within 24 hours, an incident report within 72 hours and a final report no later than one month thereafter.

• Testing of digital operational resilienceRegulatory complianceDORA#

  We carry out recurring tests of our resilience. Penetration tests are performed by an independent external party, while continuity exercises are conducted internally. Tests are documented and followed by a plan for remediation and upcoming tests.

• How do you share information about threats and vulnerabilities?Regulatory complianceDORA#

  We continuously monitor and identify cyber threats and vulnerabilities via established sources and have a procedure for sharing relevant threat information, both internally and with affected customers and collaboration partners where appropriate. The aim is to be able to act quickly on new threats and to contribute to stronger shared resilience.

• Management of ICT third-party riskRegulatory complianceDORA#

  Appropriate controls are applied at procurement and on an ongoing basis throughout the contract term to reduce risks linked to critical subcontractors.

• Exit strategy and migration planRegulatory complianceDORA#

  Contracts with critical subcontractors contain exit clauses and a documented process that secures continued delivery during a migration. We validate that the process works through recurring reviews and scenario-based tests of the exit and migration plan, so that it can be carried out in practice if a supplier needs to be replaced.

• Risk analysis and system securityRegulatory complianceNIS2#

  Risk-based analyses and risk-reducing measures are carried out in accordance with applicable law and recognized standards, primarily ISO/IEC 27001 and ISO 31000.

• Incident managementRegulatory complianceNIS2GDPR#

  For security and personal data incidents we have a documented incident management procedure to detect, handle and report incidents in accordance with applicable law, including Cybersäkerhetslagen (NIS2) and, for personal data breaches, GDPR.

• Continuity and crisis managementRegulatory complianceNIS2#

  We have plans for, among other things, backup, disaster recovery and crisis management to secure uninterrupted delivery in accordance with laws and contracts.

• Supply chain securityRegulatory complianceNIS2#

  We have controls for our direct suppliers and service providers, that is, those with whom we have a contractual relationship, to ensure that their services meet our security requirements. The requirements are adapted to how critical the supplier is to our delivery.

• Security in the acquisition, development and maintenance of networks and IT systemsRegulatory complianceNIS2#

  Security is integrated into the acquisition, development and maintenance of networks and information systems, including the handling and reporting of vulnerabilities.

• How do you evaluate that the security measures are effective?Regulatory complianceNIS2#

  We have documented policies and procedures to regularly evaluate the effectiveness of the measures for cybersecurity risk, with criteria, responsibilities, evidence, reporting and remediation.

• Cyber hygiene and trainingRegulatory complianceNIS2#

  An awareness and training plan ensures that staff and relevant stakeholders have the security knowledge their role requires.

• Personnel securityRegulatory complianceNIS2#

  We ensure that staff who handle sensitive information and critical systems meet high security requirements. Staff are background-checked before employment, and permissions are granted, reviewed and revoked throughout employment according to the principle of least privilege and zero trust, with multi-factor authentication and clearly defined roles and responsibilities.

• Access managementRegulatory complianceNIS2#

  We have a documented plan and governance for, among other things, multi-factor or continuous authentication and secure communication channels, where appropriate.