Data Protection & Privacy Policy
Effective Date: January 15, 2026 · Controller: Nordic Data Sync Infrastructure AB (Org. nr 559384-2104), Kista, Stockholm, Sweden.
Zero-Knowledge Customer Archives
Customer objects uploaded via S3 or PostgreSQL backup clients are treated as opaque encrypted ciphertext. Nordic Data Sync AB has no technical capability to inspect archive contents when client-side encryption is enabled.
Strict Jurisdictional Pinning
All storage metadata, bucket indexes, and erasure-coded shards remain strictly inside the customer's designated region under Regulation (EU) 2016/679 (GDPR). Edge ingest gateways operate without persistent payload logging.
| Infrastructure Facility | Entity & Jurisdiction | Role | Safeguards |
|---|---|---|---|
| Stockholm ARN-1 | Nordic Data Sync Infrastructure AB (Sweden) | Primary Storage & KMS | ISO/IEC 27001:2022, EU/EEA |
| Helsinki HEL-2 | FinVault Colocation Oy (Finland) | Physical Rack & Hydro Power | ISO/IEC 27001:2022, EU/EEA |
| Frankfurt FRA-1 | MainCube Campus GmbH (Germany) | Central EU Optical PoP | BSI C5, ISO 27001, EU/EEA |
Data Protection Officer (DPO) & Security Contact
For GDPR Data Processing Agreements (Article 28), audit certificates, or security vulnerability disclosures, contact our Data Protection Officer at dpo@nordicdatasync.com or PGP key fingerprint 4F92 8C1B D03A 771E 9941 0B2C E810 55A3 91D0 4412.