How we protect your data, and our own delivery.
This page collects what contracts, procurement teams and IT managers usually ask about: where the services run, which suppliers are involved, how you get your data out, and how to report a vulnerability to us.
Updated 2026-10-28Our own servers in Stockholm, European cloud services
Own infrastructure
POISE runs its own servers at Bahnhof in Stockholm. That is where our hosting, our internal systems and this website live.
Microsoft 365 and Azure
Your Microsoft services run in your own tenant in Microsoft’s EU region. POISE administers them on your behalf; the agreement with Microsoft is yours.
This website
poise.se loads nothing from third parties: no external fonts, scripts, analytics or embeds. No cookies, no browser storage. Statistics use a hash of the IP address that changes every day.
No transfers outside the EU/EEA
POISE’s own processing of personal data takes place within the EU/EEA. For platforms you license yourselves, such as Microsoft 365, your agreement with that provider applies.
The same standard for ourselves as for your environment
Identity and access
Multi-factor sign-in for all administration, role-based permissions, personal accounts and regular reviews of who has access to what.
Encryption
TLS 1.2 or later for all traffic. Stored secrets and backups are encrypted. The website uses HSTS with preload and a strict Content Security Policy.
Patching and hardening
Operating systems and software are updated continuously. Unnecessary services are disabled and networks are segmented.
Logging
Administrative events are logged and kept for troubleshooting and investigation. Logs do not contain the content of customers’ email or files.
Backups
Daily backups of our own infrastructure, both locally in the data centre and as an encrypted off-site copy at Wasabi in an EU region. Restores are tested.
Testing ourselves
We test our own domains with the same checks we offer customers: DNSSEC, SPF, DKIM, DMARC and HTTPS configuration.
Who is involved, and where they process data
This is the list our data processing agreement refers to. Customers with an agreement are notified of changes in advance.
| Supplier | Used for | Region | Role |
|---|---|---|---|
| POISE AB, own servers at Bahnhof in Stockholm | Hosting, colocation, internal systems, website | Sweden | Own operations |
| Microsoft (365, Azure, Entra ID) | Email, files, identity, cloud | EU (EU Data Boundary) | Your provider, administered by POISE |
| WatchGuard (firewall, Wi-Fi, AuthPoint, FireCloud) | Firewall and Wi-Fi, AuthPoint MFA, FireCloud zero-trust remote access | EU · FireCloud point of presence in Stockholm | Sub-processor |
| Bitdefender GravityZone | Protection of computers and servers | EU | Sub-processor |
| Bitwarden | Password management | EU region | Your licence, administered by POISE |
| Lettermint | Outbound email from the website (contact form, mailings) | EU | Sub-processor |
| api.poise.net | Security checks, vulnerability data, news feeds | Sweden | Own operations |
| Wasabi Technologies | Encrypted off-site backups | EU region | Sub-processor |
| Bahnhof | Data centre and colocation for POISE’s own servers (no logical access to data) | Sweden | Sub-processor |
Suppliers with a US parent company are used in their EU region, with the EU–US Data Privacy Framework or standard contractual clauses as the transfer mechanism. Which components are part of your delivery is set out in your agreement.
You own your data and can take it with you
Microsoft 365
The tenant is yours. On termination we hand over the administrator role and remove our own permissions.
Domains and DNS
Domains are registered in your name and can be transferred with an authorisation code. DNS zones are provided as a file.
Hosting and servers
Websites, databases and virtual machines are exported in standard formats on request.
Deletion
When the agreement ends we delete or return personal data within 30 days and confirm in writing, as set out in the data processing agreement.
Swedish company, Swedish law
POISE AB is a Swedish limited company registered in Sundbyberg, company reg. no. 556773-0923. Agreements are governed by Swedish law and the GDPR. The supervisory authority is the Swedish Authority for Privacy Protection (IMY).
Requests from authorities to disclose customer data are assessed against Swedish law. We do not disclose data voluntarily, and we inform the affected customer where the law allows.
What you sign
The data processing agreement is available as a version-dated PDF and is referenced in our quotes and agreements.
How to recognise us
Email from POISE always comes from an address ending in @poise.se, protected with SPF, DKIM and DMARC. We never ask for passwords or verification codes by email, text message or phone. Our domains are poise.se and api.poise.net.
Found something? Tell us.
Email security@poise.se with a description, steps to reproduce and the domain or service concerned. We confirm receipt and get back to you when it is fixed.
We take no legal action against anyone who reports in good faith, keeps to what is needed to demonstrate the issue, and does not spread or alter data. We do not run a bounty programme.
Machine-readable: /.well-known/security.txtNeed material for a procurement or an audit?
Tell us what you need and we will send it. We are happy to complete your security questionnaires.
No obligation. We get back to you within 24 hours.