How we handle your security, in writing

What a vendor security review asks of us: our documents, how we treat your data and access, and how to report a vulnerability. If something you need isn’t here, ask.

Request documentsTalk to us

Last updated October 2026.

Documents

Available to prospects and customers on request. We review each request and reply to your work email; some need a mutual NDA first.

Document library

Updated October 2026

  • Security overview

    How we secure our own systems and people, and how we access customer environments.

    Under NDA

  • Data processing agreement

    Our standard DPA, including data residency, retention and deletion terms.

    Available on request

  • Subprocessor list

    The third parties that process customer data, and what each one is used for.

    Available on request

  • Vendor security questionnaire

    Completed in your format, or our standard responses if you don’t have one.

    Available on request

  • Mutual NDA

    Signed before any sensitive discussion or document exchange.

    Available on request

How we treat your data and access

The commitments behind every engagement. The specifics for yours go in your contract and DPA.

  1. 01

    Least access, for the least time

    Read-only connectors wherever they’re enough. Anything more is scoped, approved by you and logged.

  2. 02

    Actions only under your runbooks

    We act in your environment only in ways you approve in advance, and every action is reversible.

  3. 03

    Encrypted in transit and at rest

    Customer data is encrypted wherever it’s stored or moved, including in our own tooling.

  4. 04

    Residency agreed in writing

    Where your data is processed and stored is set out in your DPA for each engagement.

  5. 05

    Retention you can see

    How long we keep data, and how it’s deleted at the end of an engagement, is agreed up front.

  6. 06

    NDA before anything sensitive

    A mutual NDA comes before architecture reviews, findings or any document exchange.

Frameworks we map to

Heimdall and Ragnarøk produce evidence your auditors can follow for the frameworks you operate under.

  • SOC 2
  • ISO 27001
  • PCI DSS
  • HIPAA
  • PIPEDA
  • GDPR

Responsible disclosure

Found a vulnerability in one of our systems? Tell us privately, give us reasonable time to fix it, and we won’t pursue good-faith research.

Report to
info@svalbard.ca
Machine-readable
/.well-known/security.txt
Please include
Affected URL or system, steps to reproduce, impact

Running a vendor review?

Send us your questionnaire, or book thirty minutes and we’ll walk your security team through how we operate.

Book a coverage reviewRequest sample report