Enterprise compliance expertise and operations

Compliance expertise

Opsio's core service is helping regulated enterprises achieve and maintain their compliance posture. Below, each framework shows what Opsio carries itself and what we deliver for customers. Supporting documentation is available for procurement review under NDA.

• ISO 27001:2022

  Opsio: India scope · Customer programs

  Opsio: ISO 27001 certified at our Bangalore delivery center (scope covers operations staff and development activities there). For customers: we lead full ISO 27001 implementation programs — gap analysis, ISMS design, policy authorship, internal audit, and Stage 1/Stage 2 audit support. Multiple customers have achieved certification via this approach.

• SOC 2 Type II

  Customer readiness programs

  Opsio: not currently SOC 2 attested as a firm. For customers: we run SOC 2 readiness programs — control mapping, evidence automation, monitoring setup, and auditor liaison through the observation window. Our architects are familiar with the Security, Availability, Confidentiality, and Processing Integrity trust service criteria.

• GDPR (EU 2016/679)

  Article 28 processor

  Opsio: data processor under GDPR Article 28 for customer personal data we handle during managed operations. Standard Contractual Clauses on file for any transfer to our India team. For customers: DPIA support, controller-processor agreement drafting, and technical implementation of data subject rights tooling.

• NIS2 Directive

  Customer compliance programs

  Opsio: operational practices aligned with NIS2 expectations for essential and important entities. For customers: full NIS2 compliance programs — applicability assessment, risk analysis, article-21 controls mapping, incident reporting integration with MSB, and third-party risk management.

• HIPAA (US customers)

  BAA available · Customer architectures

  Opsio: Business Associate Agreement available for US healthcare customers. For customers: HIPAA-ready architecture on AWS, Azure, or GCP with audit controls, encryption, and BAA chain management. Delivered to several mid-size US healthcare workloads.

• DORA (EU 2022/2554)

  Customer compliance programs

  For customers in financial services: DORA ICT risk management program, third-party-risk register, incident classification, testing program (TLPT), and board reporting templates. Opsio architects have delivered this for banks and insurers in Sweden and the Nordics.

• DPDPA (India)

  India operations · Customer programs

  Opsio: operations at the Bangalore delivery center align with India's Digital Personal Data Protection Act. For customers: DPDPA readiness assessments, consent architecture, retention controls, and CERT-In incident reporting pipelines.

Subprocessors

Opsio engages the following subprocessors to deliver services. The current authoritative list is maintained internally and provided as an annex to the DPA on request. Hyperscaler region selection is configurable per customer contract.

Customers may object to new subprocessors within the 30-day notice window. Engagement-specific subprocessors (monitoring agents, SIEM platforms, etc.) are disclosed in the Statement of Work.

Data residency

Customer production data is processed in the cloud region you select. For European customers we default to EU/EEA regions (AWS eu-north-1 Stockholm, Azure Sweden Central, GCP europe-north1 Finland) unless contractually agreed otherwise.

Opsio personnel access customer environments via named accounts with MFA and just-in-time elevation. Support operations are conducted from Sweden (primary) and India (delivery center). Personnel access outside the EEA uses Standard Contractual Clauses where applicable.

Backups and logs inherit the customer's selected region by default. Cross-region replication for disaster recovery is customer-configurable.

Responsible disclosure

Security researchers who identify a vulnerability in Opsio-operated systems are encouraged to report it via encrypted email. We commit to acknowledging receipt within one business day and providing a remediation timeline within five business days. We do not pursue legal action against good-faith research that follows these guidelines.

Report to: security@opsio.se