• *Multi-Region Deployment*: Our infrastructure spans multiple availability zones
• *Network Segmentation*: Virtual private clouds with segregated networks based on trust levels and organizational boundaries. Firewalls are also enabled.
• *Defense in Depth*: Multiple layers of security controls ensuring single point failures don't compromise the network

• Encryption at Rest: AES-256 encryption for all data stored in cloud environments.
• Encryption in Transit: TLS 1.2+ for all data transmission over public networks.
• Key Management: Secure cryptographic key lifecycle management with vendor-provided services where appropriate.
• Backup Security: Encrypted backups with 1-year retention for availability requirements.

• Principle of Least Privilege: Users receive only the minimum access required for their role.
• Multi-Factor Authentication: Enforced for critical systems and privileged accounts.
• Single Sign-On (SSO): Streamlined access management where security requirements permit.
• Regular Access Reviews: Systematic review of user permissions to identify unnecessary access.
• Session Monitoring: Privileged activities logged and monitored for security analysis.
• Secure Offboarding: Immediate access suspension upon employee departure.

Secure Development

• Security by Design: Security considerations integrated into development phases.
• Peer Code Review: All code changes reviewed before deployment.
• Runtime Analysis: Automated security testing implemented into production environment.
• Vulnerability Management: Regular monitoring and patching of identified severe vulnerabilities.

GDPR Compliance

• Data Protection Officer: Dedicated role ensuring compliance with EU data protection regulations.
• Lawful Basis: Clear legal foundations for all personal data processing activities.
• Data Subject Rights: Comprehensive processes for handling access, rectification, and deletion requests.
• Privacy by Design: Privacy considerations built into data processing systems.

• Handling Procedures: Specific protection measures based on data sensitivity levels.
• Retention Policies: Clear guidelines for data retention periods and secure disposal.

Given our work with publicly listed companies, we maintain rigorous controls for handling insider information in full compliance with applicable laws and regulations, with designated personnel responsible for insider issues.

• Disaster Response Team: Designated team with clear roles and escalation procedures.
• Impact Assessment: Systematic evaluation of incidents with High/Medium/Low prioritization.
• Containment Procedures: Immediate steps to limit incident impact and prevent spread.
• Recovery Planning: Comprehensive procedures for system restoration and business continuity.

• Crisis Communication Plan: Formal procedures for internal and external incident communication.
• Regulatory Notification: Compliance with GDPR 72-hour breach notification requirements.
• Post-Incident Review: Systematic analysis and improvement planning after each incident.

• Disaster Recovery: Documented procedures for maintaining operations during disruptions.
• Backup Systems: Redundant systems and data backups to ensure service availability.

Our governance structure reflects our collaborative culture with distributed leadership across the organization:

• Management Team: Strategic oversight of information security aligned with company missio.
• IT Coordination Group: Tactical decisions and major security activities led by CFO.
• Technology Team: Handles security monitoring and implementation inside the teams.

• Internal Audits: Regular internal security audits conducted by trained personnel.
• Continuous Monitoring: Ongoing assessment of security controls effectiveness.
• External Validation: Plans for independent security assessments and certifications.

Supply Chain Security 

• Vendor Assessment: Formal security evaluation process for all third-party providers.
• Contractual Requirements: Security obligations built into all vendor agreements.
• Regular Reviews: Critical vendors are reviewed annually.

Office Security

• Secure Facilities: Physical security controls at our Helsinki and Stockholm offices.
• Access Controls: Restricted access to sensitive areas and equipment.
• Equipment Protection: Secure storage for network equipment and servers.
• Environmental Controls: Appropriate environmental conditions for data storage.

Security Culture 

• Security Awareness: Regular training tailored to individual roles and responsibilities.
• Incident Recognition: Training on identifying and reporting security incidents.
• Policy Education: Comprehensive education on security policies and procedures.