Compliance & Security
Your data in Europe, under European law, in an audited environment.
basis.no is a Norwegian-owned provider that runs its own infrastructure in Norway and Germany, with no American cloud provider in the chain. Our information security management system is certified to ISO/IEC 27001 and our controls are audited by BDO under ISAE 3402 Type 2. This page explains what that means, and what documentation you can get from us.
Where your data lives decides who can reach it
Encryption and access control protect data from attackers. Jurisdiction decides which governments can legally demand it. Both matter when you choose where to run critical systems.
Most public cloud capacity in Europe is operated by companies headquartered in the United States. Under US law, notably the CLOUD Act, these companies can be ordered to hand over data they control, even when that data is stored in a European data centre. For many organisations this conflicts with GDPR obligations, sector rules or simply with their own risk appetite.
At the same time, the EU's DORA regulation for the financial sector and the NIS2 directive for essential and important entities make customers accountable for the security of their ICT suppliers. You need to know what your provider does, and be able to prove it.
- Jurisdiction – which country's laws apply to your data and to the company that operates it
- Location – which data centres your data and backups are physically stored in
- People – who can access your systems, and how they are vetted
- Evidence – which independent audits show that the controls actually work
The rest of this page answers these four points for basis.no.
Data sovereignty
We operate a managed private cloud that is owned, run and staffed in Europe. It gives you a European alternative to the global hyperscalers for storing and processing business-critical data.
Our data centre locations:
The sites are geographically separated, so production and backup can be placed in different locations within the same country.
Certifications and audits
Two independent frameworks cover how we manage information security. One certifies the management system; the other audits the controls we run for customers.
The international standard for an information security management system (ISMS). It requires us to identify risks to our own and our customers' information, implement controls against them, and improve the system continuously. An accredited certification body audits us every year.
- Certified by
- BSI
- Certificate no.
- IS 675272
- Holder
- basis.no AS
- Scope
- Delivery of hosting, operation, Security Operations Center (SOC) and support services of business critical applications and solutions
- Verification
- Certificate available on request, and verifiable in BSI's public certificate directory
An international assurance standard for service organisations. An independent auditor examines the controls we operate on behalf of customers, such as access management, change management, backup and incident handling, and issues a report. Your own auditor can rely on this report instead of auditing basis.no directly.
- Report type
- Type 2: tests that controls are designed correctly and worked as described throughout the audit period
- Auditor
- BDO
- Frequency
- Annual
- Access
- Shared with customers and their auditors on request, under NDA
ISO 27001 shows that a security management system is in place and maintained. ISAE 3402 shows that specific controls worked as described during the audit period. Auditors in regulated industries usually ask for both.
DORA and NIS2
DORA is an EU regulation and NIS2 is an EU directive, not certificates. They place obligations on you as the customer, and many of those obligations extend to your ICT providers. Our operations are set up to support them.
A short supply chain
What this means in practice when basis.no is your ICT provider:
- Contract terms – service descriptions, SLAs, data location and security requirements are stated in writing, as the regulations require
- Incident notification – we notify you of incidents affecting your services, so you can meet your own reporting deadlines
- Audit and access rights – you, your auditors and your supervisory authority can audit the services we deliver to you
- Tested recovery – backup and disaster recovery are tested, documented and reported
- Exit support – you own your systems and data, and we support an orderly handover if you move them
- Short supply chain – we use no subcontractors apart from the data centre facilities that house our own hardware
How we protect your systems
These controls are part of our ISMS and apply across our hosting and operations services. The exact scope for your systems is set out in your service agreement.
| Area | What we do |
|---|---|
| Physical security | Data centres with access control, redundant UPS, dual power supply, fire suppression and fibre connectivity between sites |
| Access control | Personal, named accounts with least-privilege access; staff with a police certificate (politiattest) on request |
| Hardware security keys | All administrative staff must log in with a YubiKey. A YubiKey is a small physical security key that plugs into a USB port or is tapped against a phone. It proves who you are using a cryptographic key stored on the device, which cannot be copied. Unlike one-time codes by SMS or app, it also checks which website it is talking to, so a fake login page cannot capture a usable login. Without the physical key, a stolen password is not enough. |
| Patching | Operating systems and platform components patched on a fixed maintenance routine |
| Monitoring | Infrastructure and platform services monitored 24/7/365, with engineers on call outside office hours |
| Backup | Scheduled backups stored at a secondary location; air-gapped backup available as protection against ransomware |
| Disaster recovery | Recovery procedures documented and tested, with results reported |
| Incident management | Defined process for detecting, handling, escalating and reporting security incidents |
| Change management | Changes to production planned, approved and logged through our service desk |
| Supplier control | No subcontractors apart from the data centre facilities that house our hardware; these are assessed and followed up as part of the ISMS |
Privacy and GDPR
When we host or operate systems that contain personal data, you are the data controller and basis.no is the data processor. We process your data only on your instructions.
You (controller)
- Decide which personal data is processed, and why
- Decide where it is stored: Norway or Germany
- Decide backup retention periods
- Own your systems and data
basis.no (processor)
- Processes data only as instructed in the data processing agreement
- Keeps data within the agreed location
- Protects it with the controls described on this page
- Notifies you without undue delay of personal data breaches
- Supports you in responding to data subject requests
A data processing agreement (DPA) is included in every contract. We use no subcontractors apart from the data centre facilities that house our own hardware.
What to ask any hosting provider
Security and compliance claims are easy to make. These are the questions we recommend asking, and our answers.
- Which country is your company owned and controlled from?Norway. basis.no AS is Norwegian-owned and operated.
- Can a foreign authority compel you to hand over our data?We are Norwegian-owned with no US parent company in the hosting chain. Assess the applicable jurisdictions and any external services for your setup.
- Exactly where are our data and backups stored?In the data centre locations named in your contract, in Norway or Germany.
- Which certifications do you hold, and can we see them?ISO/IEC 27001 (BSI, IS 675272) and an ISAE 3402 Type 2 report from BDO. Both are available on request.
- Who can access our systems, and how do they log in?Named administrators with least-privilege access, who must authenticate with a YubiKey hardware key. If you require it, only staff with a police certificate (politiattest).
- Which subcontractors are involved?None, apart from the data centre facilities that house our own hardware.
- How do you support our DORA or NIS2 obligations?Through written contract terms, incident notification, audit rights, tested recovery and exit support. See section 04.
- Is the backup protected against ransomware?Air-gapped backup is available, so a copy of your data is out of reach of an attacker on the network.
Documentation you can request
For a procurement process, a vendor assessment or an audit, we provide the following documents.
ISO/IEC 27001 certificateCopy of the BSI certificate, including scope and validity.
ISAE 3402 assurance reportThe latest Type 2 report from BDO on our controls, shared under NDA.
Data processing agreementOur standard GDPR data processing agreement. A DPA is included in every contract.
Security questionnaireAnswers to your vendor or third-party risk questionnaire.
Common questions
Is basis.no "DORA certified" or "NIS2 certified"?
No provider can be, because no such certificates exist. DORA and NIS2 set requirements for relevant financial and essential entities. What we offer is a service, contract and documentation set up to help you meet the requirements that apply to your ICT providers.
What is the difference between ISO 27001 and ISAE 3402?
ISO 27001 certifies that we run a management system for information security and keep improving it. ISAE 3402 is an auditor's report on whether specific controls we operate for customers were designed and working as described. One shows the system, the other shows the evidence.
Does a European data centre owned by an American company give the same protection?
Not necessarily. The location of the data centre decides where data is stored, but the nationality of the operator decides which laws it is subject to. With basis.no, both the infrastructure and the company are European.
Can we choose between Norway and Germany?
Yes. You choose the location for your systems and backups when the service is set up, and it is stated in your contract.
Can we audit basis.no ourselves?
Yes. In addition to the ISAE 3402 report, customers and their auditors can audit the services we deliver to them, as regulated entities are required to be able to do under DORA.
Which services does this page apply to?
All services basis.no delivers from its own infrastructure, including Hosting for SAP, Odoo Hosting and Managed Kubernetes.
Need documentation for an assessment?
Tell us what your auditor, procurement team or regulator needs. We send the relevant certificates, reports and agreements, and answer your security questionnaire.