Security overview

Hosting and data residency

The service runs on European infrastructure providers, with application data stored in the EU. The table below lists our hosting and processing providers and their regions. The authoritative sub-processor list — including the data categories each vendor handles — is published in the Data Processing Agreement.

Tenant isolation

Kursregistrering.se is a multi-tenant service. Every database table holding organization data is protected by PostgreSQL row-level security (RLS): queries are scoped to the requesting organization at the database layer, not only in application code. Tenant isolation is covered by automated tests that run in CI on every change.

Access control and authentication

Organization users authenticate with individual accounts through our managed authentication provider. Every state-changing server operation passes through a shared authorization guard that verifies the session and the user's organization membership and role before touching any data. Participant-facing pages (registration status, check-in, evaluations) use single-purpose tokens instead of accounts, and all public endpoints are rate-limited.

Encryption

All traffic to and from the service is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers, including database storage and backups. Secrets and API keys live in the hosting platform's encrypted configuration, never in the codebase.

Backups and continuity

The production database is covered by our database provider's automated backups. The application layer is stateless and runs on managed, redundant infrastructure, so it can be redeployed or rolled back independently of the database.

Incident response

We maintain an internal breach-response runbook aligned with GDPR Articles 33 and 34. Incidents are triaged by a named incident owner, contained, recorded in an internal incident log, and assessed against the notification duties in the GDPR and our Data Processing Agreement.

Customer notification commitment

We notify affected customer organizations without undue delay after becoming aware of a significant incident affecting their data or their use of the service. For customers in scope of NIS2, we are preparing a phased notification commitment that includes a 24-hour early warning.

Sub-processor management

We use a small number of vetted sub-processors, each bound by a data processing agreement with breach-notification duties. The complete list is published in our Data Processing Agreement, and changes are announced through a DPA version bump that prompts every customer organization to review them (notify-and-object).

Vulnerability disclosure

We welcome good-faith reports of security vulnerabilities in Kursregistrering.se.

Security contact: security@kursregistrering.se

This channel is also published in machine-readable form at /.well-known/security.txt (RFC 9116).

What to report

Report anything you believe affects the confidentiality, integrity, or availability of the service or its data — for example authentication or authorization flaws, tenant-isolation issues, or injection vulnerabilities. Include steps to reproduce, and do not access or modify data that is not your own.

What to expect

We acknowledge reports, investigate them, and keep you informed of the outcome where we can. We do not currently operate a bug-bounty program.

Safe harbor

We will not initiate legal action against researchers who report vulnerabilities in good faith, make reasonable efforts to avoid privacy violations and service disruption, and allow us reasonable time to remediate before any public disclosure.