Security overview

Hosting and data residency

The service runs on European infrastructure providers, with application data stored in the EU. The table below lists the providers and their regions. The full sub-processor list, with data categories per vendor, is published in the Data Processing Agreement.

Tenant isolation

Kursregistrering.se is a multi-tenant service. Every database table holding organization data is protected by PostgreSQL row-level security (RLS). Queries are scoped to the requesting organization at the database layer, not only in application code. Tenant isolation is covered by automated tests that run on every change.

Access control and authentication

Organization users sign in with individual accounts through our managed authentication provider. Every state-changing server operation passes through a shared authorization guard. The guard verifies the session and the user's organization membership and role before touching any data. Participant-facing pages use personal single-purpose links instead of accounts, and all public endpoints are rate-limited.

Encryption

All traffic to and from the service is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers, including database storage and backups. Secrets and API keys live in the hosting platform's encrypted configuration, never in the codebase.

Backups and continuity

The production database is backed up automatically by our database provider. The application layer is stateless and runs on managed, redundant infrastructure. It can therefore be redeployed or rolled back independently of the database.

Incident response

We maintain an internal breach-response runbook aligned with GDPR Articles 33 and 34. A named incident owner triages and contains incidents. Every incident is recorded in an internal log and assessed against the notification duties in the GDPR and our Data Processing Agreement.

Customer notification commitment

We notify affected customer organizations without undue delay after becoming aware of a significant incident affecting their data or their use of the service. For customers in scope of NIS2, we are preparing a phased commitment that includes a 24-hour early warning.

Sub-processor management

We use a small number of vetted sub-processors, each bound by a data processing agreement with breach-notification duties. The complete list is published in our Data Processing Agreement. Changes are announced through a new Agreement version that every customer organization is asked to review, with a right to object.

Vulnerability disclosure

We welcome good-faith reports of security vulnerabilities in Kursregistrering.se.

Security contact: security@kursregistrering.se

This channel is also published in machine-readable form at /.well-known/security.txt (RFC 9116).

What to report

Report anything you believe affects the confidentiality, integrity, or availability of the service or its data. Examples: authentication or authorization flaws, tenant-isolation issues, or injection vulnerabilities. Include steps to reproduce. Do not access or modify data that is not your own.

What to expect

We acknowledge reports, investigate them, and keep you informed of the outcome where we can. We do not currently operate a bug-bounty program.

Safe harbor

We will not initiate legal action against researchers who report vulnerabilities in good faith. This assumes reasonable efforts to avoid privacy violations and service disruption, and that we get reasonable time to remediate before disclosure.