Security answers

Last updated 9 November 2026

Draft. The company details in brackets are filled in when the company is registered.

These are the questions an IT or security review usually sends a new vendor. If yours asks something that is not here, write to security@koncernify.com. The security page has the short version.

Company

Supplier	[Company name AB], [org. nr], [Street, postcode, city], Sweden
Certifications	None yet: no ISO 27001, SOC 2 or ISAE 3402 report. What we do instead is on this page. The record can be checked without trusting us (see Integrity below).
Penetration test	No outside test has been done yet. A written threat model is available on request.
Who has production access	One person runs Koncernify today. Customer data is opened only to answer the customer’s own support request, or where the law requires it. An owner can download everything at any time, so the data does not depend on us.

Hosting and data location

Where the service runs	Cloudflare Workers. Each request is handled in the nearest Cloudflare data centre, which for a user in Sweden is usually in the EU.
Where data is stored	A Cloudflare D1 database under Cloudflare’s EU jurisdiction.
AI processing	A setting of each workspace, chosen by an owner. Off: nothing is sent to a model. Ours: Claude on Amazon Bedrock, in AWS regions inside the EU; if the EU route fails, the model switches off and never falls back outside the EU. Your own: Claude on Bedrock in your AWS account, on Microsoft Foundry in your Azure tenant, or your own Anthropic key. A new workspace starts with the AI off.
Outside the EU	Data is stored in the EU. Cloudflare and AWS are US companies, and sign-in goes through Google or Microsoft. Whatever your own assistant reads goes to its provider under your account. Transfers are covered by the EU–US Data Privacy Framework or standard contractual clauses.
Subprocessors	Listed on the subprocessors page. Owners are told by email 30 days before one is added or replaced, and may object.

Encryption

In transit	HTTPS only.
At rest	The database is encrypted at rest by Cloudflare.
Ledger connections	Encrypted again with a key for your workspace alone. That key is encrypted with a master key held outside the database. Deleting the workspace destroys its key.
Auditor links	Only a hash of the token is stored, so a copy of the database opens no link.

Sign-in and access

Sign-in	Google or Microsoft work accounts. We store no passwords.
Two-step sign-in	Set and enforced in your Google Workspace or Microsoft 365. Koncernify cannot see whether it was used.
Roles	Owner, controller, accountant and auditor (read only). Agents get their own keys, limited to ledgers, accounts and amounts. They draft. They cannot approve. Below an auto-post limit an owner sets (0 by default), an agent’s journal posts first and needs sign-off at month end. A person approves within the limits an owner sets, and not their own drafts while a colleague can review them. A sole reviewer’s own approvals are marked in the record.
Admin keys	An owner can make a key for automation that reads the record and changes the rules. Treat it like an owner’s password.
Sessions	A sign-in lasts 12 hours.
Large amounts	An owner can require a sign-in within the last 15 minutes to approve above an amount they choose.
Keys and limits	Requests are capped per key, address and workspace. Twenty wrong keys in ten minutes shut an address out. An owner can revoke any key at once.
Leavers	An owner removes the person in Koncernify, and the removal is signed.

Integrity and logging

Decisions	Each approval is signed with the person, the time and the exact lines. Every hour an outside timestamp authority (DigiCert, Sectigo or FreeTSA) stamps a hash of the signatures. It receives the hash only.
Changes to rules and roles	Signed and shown in the month’s log.
Ledger read-back	The open month is read back every night, so a journal changed after approval shows in the record. The period report reads the whole period again.
Checking without us	An auditor can check the signatures on their own computer. How.

Backups, incidents and exit

Backups	The database keeps 30 days of history and can be restored to any point in it. A restore point is also taken before every release that changes the database.
Personal data breach	We tell you within 48 hours of becoming aware, as section 8 of the data processing agreement says.
Reporting a problem	security@koncernify.com. We reply within two working days.
Audit rights	Once a year, with 30 days’ notice, under section 10 of the data processing agreement.
Leaving	An owner can download everything at any time. The workspace is deleted 90 days after the subscription ends, and its backups expire within 30 days after that. The record of approved journals is kept read-only for the bookkeeping retention period and handed over on request.

AI

Model	Ours is Claude Sonnet 5.5 from Anthropic, on Amazon Bedrock in the EU. With your own endpoint, the model and its provider are yours, under your own agreement with them.
With the AI off	Every check, every drafted answer, the record and the connected assistants still work. Drafting journals in Koncernify, AI checklist steps and questions in the box are switched off.
Changing it	Only an owner can. Each change is kept in the signed record of control changes, without the key. A key you give is encrypted with the workspace's own key and never shown again.
What uses it	Drafting journals, writing checklist steps and answering questions in the box. Every check, every drafted answer and every rule is code, not a model.
What it is sent	The question and a summary of the month: the checks’ findings, entry lines with their text and amounts, and any voucher you name. Never the full ledger file.
Training	Your data trains no model. On our route, Bedrock does not share it with Anthropic.
Who decides	A person, or a rule a person set. A journal the model drafted is labelled as AI and always waits for a person.
Your own assistant	Copilot, Claude or ChatGPT connected to Koncernify run on your own account with that provider. They read what the connected person’s role may read. They cannot approve. Their journals follow the same limits as an agent’s.

NIS2 and supplier requirements

Cybersäkerhetslagen has applied since 15 January 2026. A company it covers must set security rules for its suppliers. Send us your supplier annex and we answer it clause by clause, from this page and the data processing agreement.