Colleagues talking, with Centuri hosting and data storage: servers in Sweden, Swedish hosting partner, GDPR and NIS2

Security and operations

Data stored in Sweden, with security you can audit

Centuri stores all data on servers in Sweden, with a Swedish hosting partner and under Swedish law. Here you can see how the platform is protected, operated and kept compliant with GDPR and NIS2.

All data stored in Sweden, never outside the EU/EEA
Swedish hosting partner with no US ownership
Data processing agreement with every customer

Last updated: [date]

At a glance

The key facts about security and operations in Centuri

Area	How it works in Centuri
Data storage	Servers in Sweden. No data is stored or processed outside the EU/EEA.
Hosting partner	Fouredge, with data centres in Sweden. Certified to ISO 9001, ISO 14001 and ISO 27001.
ISO 27001	Centuri is built on the principles of ISO 27001.
US CLOUD Act	Does not apply. Centuri uses Swedish suppliers with no US ownership.
Encryption	All traffic is encrypted with TLS 1.2 or later.
Access control	Role-based permissions, down to individual fields in a form.
Logging	All events and changes are logged, including at field level.
Backup	Daily backups, a full copy every week and a restore test every quarter.
Availability	Redundant hosting with load balancing.
Incidents	A documented process with response times and escalation. Notification within 72 hours under GDPR.
GDPR	Centuri is a data processor and signs a data processing agreement with every customer.
Support	Swedish support with defined response times.

Data storage and sovereignty

Where is our data stored?

Centuri stores all customer data on servers in Sweden. Hosting is managed by Fouredge, a Swedish infrastructure partner with data centres in Sweden, and no data is stored or processed outside the EU/EEA.

For organisations in healthcare, life science and manufacturing, knowing where information is held is often a requirement. With Centuri, you have a documented answer when customers, auditors or authorities ask.

Swedish law applies

The hosting environment is owned and operated by Swedish companies. Your data is therefore not subject to laws that give foreign authorities access, such as the US CLOUD Act.

Centuri overview showing primary storage and backup in Sweden and hosting partner Fouredge with ISO certifications

Information security

How does Centuri protect our information?

Centuri is built on the principles of ISO 27001, and security is part of how the platform is developed and operated. Security is reviewed regularly through security audits and penetration tests. Centuri staff only access customer data when it is needed to deliver the service.

Encryption

All traffic to and from Centuri is encrypted with TLS 1.2 or later. File transfers use SFTP.

The right people see the right information

Permissions are set by role, down to individual fields in a form.

Every change can be traced

All events are logged, including changes at field level. Hashing detects if content has been changed without being logged. The log can be exported ahead of an internal or external audit.

Operations and continuity

Operations that hold up, even when something goes wrong

The platform runs in a redundant environment with load balancing, so a fault in one component does not stop the service.

Backups that are tested

Centuri takes a backup every day and a full copy every week. Restores are tested every quarter, so you know they work when you need them.

Incidents follow a fixed process

A security incident is handled according to a documented procedure with response times and escalation. Affected customers are informed immediately, and personal data breaches are reported within 72 hours under GDPR.

Planned updates

Updates are carried out in scheduled maintenance windows.

Swedish support

You get help from Swedish support with defined response times and escalation.

Your data, your control

Your data is yours, even when the contract ends

The data is yours. Centuri only uses it to deliver the service. When the contract ends, you get your information back, and it is then deleted.

Questions about security and operations

Are we affected by the US CLOUD Act if we use Centuri?

No. The US CLOUD Act gives US authorities the right to request data from US companies, even when the data is stored abroad. Centuri and its hosting partner Fouredge are Swedish companies with no US ownership, and your data is stored on servers in Sweden. It is therefore not covered by the act.

Does Centuri sign a data processing agreement?

Yes. Centuri is a data processor under GDPR and signs a data processing agreement with every customer. The agreement describes which personal data is processed, for what purpose and how it is protected. Centuri only processes the personal data to deliver the service.

Which sub-processors does Centuri use?

Centuri uses a small number of sub-processors to deliver the service, including Fouredge for hosting and data storage in Sweden. All sub-processors are listed in the data processing agreement, and you are informed before a new sub-processor starts processing your data.

How does Centuri help us comply with NIS2?

NIS2 sets requirements for risk management, incident reporting and business continuity planning in essential and important entities. Centuri provides documentation, traceability and tools for exactly that: risk assessments with actions, incidents in traceable workflows and controlled continuity procedures. Centuri is also a supplier you can present in your own supplier assessment.

Questions about security and operations?

Talk to us about the hosting environment, our security work or your regulatory requirements. You will get answers from someone who knows the technology.