Compliance
Certifications
Independent audits confirm how we protect information, deliver our services and keep running through disruption. The same standards apply to every customer.
- ISO/IEC 27001
- ISO 9001
- ISO 22301
ISO/IEC 27001
Information security management
What it means
ISO/IEC 27001 sets the requirements for an information security management system: how risks are assessed, which controls are chosen and how their effectiveness is checked.
What it means for you
Your data is protected by audited controls, and you can reference our certificate in your own audits and supplier reviews.
- Scope
- Data center operations and managed services
ISO 9001
Quality management
What it means
ISO 9001 confirms that our services are delivered through defined, measured processes that are reviewed and improved continuously.
What it means for you
You get consistent service — from onboarding to changes and incident handling — no matter which engineer you work with.
- Scope
- Data center operations and managed services
ISO 22301
Business continuity management
What it means
ISO 22301 covers how an organization prepares for, responds to and recovers from disruptions such as power, network or supplier failures.
What it means for you
Our own continuity plans are tested regularly, so the services you depend on keep running when something goes wrong.
- Scope
- Data center operations and managed services
Certificates are issued by an accredited certification body after an external audit. They are renewed every three years, with surveillance audits every year.
Data protection
GDPR and EU data residency
Your data is stored and processed in Bulgaria, inside the European Union, under a clear data processing agreement.
Data stays in the EU
Production data, backups and replicas are stored in BG‑SOF‑1 in Sofia. We do not transfer data outside the EU without your written instruction.
Data processing agreement
A data processing agreement under Article 28 GDPR is part of every contract, together with the list of our sub-processors.
Need-to-know access
Only named engineers can access customer systems, always with multi-factor authentication, and every access is logged.
Breach notification
If a personal data breach affects your data, we inform you without undue delay, so you can meet your own 72-hour notification duty.
Need documents for an audit or a tender?
We share certificates, our data processing agreement and security documentation on request, usually within one business day.