Start free checkFree check Book a demo

Security and controls

Fully EU-based. Secured at every layer.

Built in Göteborg, hosted on Google Cloud in the EU, with AI on EU-hosted models. Every layer, from sign-in to storage, is designed to keep your data yours.

Request the white paperBook a demo
01 Fully EU-based Google Cloud in Finland, a second region in Stockholm, AI on EU-hosted models
02 Your organisation Kept apart from every other customer
03 Access SSO, MFA and roles, checked on every request
Your data AES-256 at restTLS 1.2+ in transit AI assistant and agents Inside your permissions
Diagram of Fidureon’s security layers, from the outside in: fully EU-based, on Google Cloud in Finland with a second region in Stockholm and AI on EU-hosted models; your organisation, kept apart from every other customer; access, with SSO, MFA and roles checked on every request; and at the centre your data, encrypted with AES-256 at rest and TLS 1.2 or later in transit. The AI assistant and agents sit inside the access layer, within your permissions.

Security and controls, in seven parts.

The short version of our customer security white paper. Ask us for the full one.

Encryption at rest
AES-256
Encryption in transit
TLS 1.2+
Daily database backups kept
30 days
Point-in-time recovery
7 days
Data, backups and AI
EU

01EU-based

Where everything runs.

Your data, and the AI that works on it, stay in the EU. Here is what runs where.

Diagram. Built and operated by CShift AB in Göteborg, Sweden. europe-north1 (Finland): Primary region: the application, the database (with regional high availability) and evidence files. europe-north2 (Stockholm, Sweden): A daily replica of evidence files, for disaster recovery. Vertex AI (EU region): Gemini models for the assistant, agents and drafting. Mistral (EU hosting): Selected AI flows, on Mistral’s EU hosting. Database backups stay in Google Cloud’s EU locations.

02Access

Who gets in, and how far.

Every request is checked on the server, and roles decide what each person can see and do.

  • Single sign-on

    On the Enterprise plan, connect your own identity provider over SAML or OIDC, set up per organisation.

  • Multi-factor authentication

    Every user can turn on TOTP multi-factor authentication with backup codes, on every plan.

  • Roles

    Admins manage users and settings. Members work with the organisation’s records. Auditors can be given read access.

  • Protected sign-in

    Sessions are verified on every request, and sign-in is protected against password guessing and credential stuffing.

03Your data

Encrypted, and kept to your organisation.

Your records are encrypted at rest and in transit, and every query is scoped to the organisation that asks.

  • Encrypted at rest

    AES-256 for the database and every stored file.

  • Encrypted in transit

    TLS 1.2 or later, HTTPS only, everywhere.

  • Kept apart from other customers

    Every record and file belongs to one organisation, and access is checked against it on every request.

  • Isolation tested on every change

    Automated tests that try to reach another organisation’s data run on every code change.

04Resilience

Built to stay up, and to come back.

Fidureon runs on managed Google Cloud services in the EU, spread across data centres, with backups you can restore to the minute.

  • Highly available

    The application and database run across several zones in the region, and a standby database takes over automatically.

  • Private by design

    The database has no public access and is reachable only over private connections.

  • Daily backups, kept 30 days

    The database is backed up every day, and can be restored to any moment in the last 7 days.

  • A second EU region

    Evidence files are versioned and copied every day to Stockholm, for disaster recovery.

05How we build and run it

Secure from code to production.

Every change is reviewed and scanned before it ships, and production is monitored, with alerts to the operations team.

Found a vulnerability? Read our disclosure policy.

  • Reviewed and scanned changes

    Every change is reviewed, and automated checks scan dependencies, code and containers before anything reaches production.

  • No secrets in code

    Credentials live in a managed secret store, and each one is open only to the service that needs it.

  • Infrastructure as code

    The whole platform is defined in code, so every change is reviewed, versioned and reproducible.

  • Logged and monitored

    Sign-ins, data access and system events are logged, and alerts reach the operations team.

  • A full audit trail

    Every change to a record is tracked, with who made it and when.

  • Incident response

    If an incident affects your data, we tell you, and share the relevant findings.

06AI and MCP

AI that works within your permissions.

The assistant and the AI tools you connect over MCP go through the same sign-in, role checks and organisation scoping as everything else in Fidureon. Agents work inside your organisation’s data, at the autonomy you set.

Where the AI runs The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.

The AI assistant pane: “Your briefing”, prepared automatically, “Hi Elin, here is what needs your attention. 1 item is overdue, 4 more are due within 30 days.”, a list from “Review control: Securit…”, overdue by 35 days, to “Management training on cyb…”, due in 30 days, then “What you can ask” with suggestions such as “What should I do first?”, “What’s due for me this week?” and “What’s our compliance status?”, and a message field.

The assistant, inside the product

It sits beside every page, signed in as you, with a briefing built from what is due for you. It reads and changes records through the same API as you, with your role.

AI profile card for a CISO at a demo company: why you use Fidureon (“Run the ISMS and our NIS2 programme as CISO, and get the company ready for the ISO 27001 stage 1 audit in March 2027.”), goals (pass ISO 27001 stage 1 in March 2027, meet Cybersäkerhetslagen reporting duties, classify our AI systems under the AI Act), what you want from the assistant, GRC experience Expert and answers “Short and to the point”.

You decide what it knows

An admin-edited organisation profile and each person’s own AI profile shape the answers. Only you see yours, and you can change or delete it at any time.

Real product views, captured with a fictional demo company.

What the AI works on

  • The assistant and your briefingThe question you ask, with the records the assistant looks up to answer it.
  • AI agentsThe controls, evidence and records an agent works on, including agents that run on a schedule.
  • Drafting and scoringThe process or document being drafted or scored, such as a DPIA, a policy or a piece of evidence.
  • Imports and supplier repliesThe files you import controls, risks or requirements from, and supplier replies sent by email.

How it is controlled

  • Inside your permissionsThe assistant works through the same API as you, with the signed-in user’s role and only your organisation’s data.
  • Recorded in the historyChanges made by people, agents, the assistant and MCP clients show up in each record’s history.
  • You set agent autonomyFrom propose-and-wait to fully autonomous, per agent. Readiness scores and evidence proposals wait for a person by default.

MCP, for your own AI tools

  • Keys scoped to your organisationYour admins create and revoke dedicated API keys in Fidureon. A key reaches only its own organisation’s data.
  • The same checks as the appEvery MCP request passes the same authentication, authorisation and organisation scoping as the main API.
  • Logged and rate-limitedCreating, using and revoking a key is logged and visible to your admins, and MCP endpoints are rate-limited.

AI risk managementCShift AB works in line with the EU AI Act: every AI model in Fidureon goes through a structured risk analysis of its purpose, the data it handles and its impact, with oversight and transparency measures to match.

07Compliance

Aligned with the rules we help you meet.

Fidureon is built and run in line with the same frameworks it helps you meet.

  • ISO/IEC 27001:2022

    ISMS

    CShift AB runs its information security management in line with ISO 27001:2022, covering how we build, run and support Fidureon.

  • Annex A

    Mapped

    Fidureon’s own security controls are mapped and assessed against all 93 Annex A controls.

  • GDPR

    Processor

    We process your data as your processor, under a data processing agreement, and support data subject rights including deletion.

  • EU AI Act

    Risk-assessed AI

    Every AI model in the platform is risk-assessed. For your own AI systems, the product has an AI register.

  • EU Data Act

    Portable

    Your organisation’s data can be exported at any time, in a common machine-readable format.

  • MVSP

    Baseline

    The Minimum Viable Secure Product checklist is our baseline for enterprise-ready B2B security.

The white paper

Every chapter, in full.

Our customer security white paper covers each part of this page in more detail, for your vendor assessment, procurement or audit. Ask for it and we send it to you.

Request the white paper Book a security review

Or write to [email protected]

FAQ

Security questions.

Where is our data hosted?

Hosted in Google Cloud europe-north1 (Finland), with a daily copy of evidence files in europe-north2 (Stockholm). Database backups stay in Google Cloud’s EU locations.

Where does the AI run?

The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company. The assistant and agents work with the same sign-in, role checks and organisation scoping as the rest of Fidureon.

Do you support SSO and MFA?

Yes. SSO over SAML or OIDC is on the Enterprise plan, and every user on every plan can turn on TOTP multi-factor authentication with backup codes.

Can we get our data out?

Yes. In line with the EU Data Act, your organisation’s data can be exported at any time, in a common machine-readable format.

Can we connect our own AI tools?

Yes, through Fidureon’s MCP server. Your admins create API keys scoped to your organisation, every request goes through the same checks as the app, and key use is logged and rate-limited.

Can we sign a data processing agreement?

Yes. We sign a data processing agreement with every customer, and it includes the full list of sub-processors.

Can we see the technical detail for our security review?

Yes. Email [email protected] for the customer security white paper, or to set up a security review with our team. To report a vulnerability, use the same address; our vulnerability disclosure policy explains the scope and how we respond.

Bring your security questions to a demo.

We walk through hosting, access and AI with your security team, using your own frameworks. Or start with the free readiness check for ISO 27001 or the EU AI Act.

Book a demoStart free readiness check