'/%3e%3crect%20y='52.04'%20width='52.04'%20height='104.09'%20fill='rgb(120,%20101,%20255)'/%3e%3cpath%20d='M341.38,65.91A47.24,47.24,0,0,0,326.14,55.7,46.74,46.74,0,0,0,307.67,52H260.22V156.11h47.45a46.57,46.57,0,0,0,18.47-3.73,47.24,47.24,0,0,0,15.24-10.27,47.53,47.53,0,0,0,14-33.72V99.7a46.32,46.32,0,0,0-3.73-18.62A48,48,0,0,0,341.38,65.91Zm-.2,42.48a32.3,32.3,0,0,1-9.8,23.72,36.9,36.9,0,0,1-10.75,7.17,32.59,32.59,0,0,1-13,2.63H274.08V66.18h33.59A33.46,33.46,0,0,1,341.18,99.7Z'%20fill='rgb(35,%2010,%2088)'/%3e%3cpath%20d='M425.54,91.91A37,37,0,0,0,362.37,118a36,36,0,0,0,10.83,26.13A37.4,37.4,0,0,0,385,152.11a36.42,36.42,0,0,0,14.41,3,35.27,35.27,0,0,0,15.17-3.31c4.69-2.14,9.45-5.85,14.28-11l-9.18-8.34q-9.3,10.33-20.27,10.34a23.84,23.84,0,0,1-17.51-7.31c-4-3.86-6.28-7.65-6.76-11.38h60.48l.75-5.86a36.91,36.91,0,0,0-10.82-26.34ZM375.13,112c.48-3.79,2.83-7.59,6.82-11.44a23.07,23.07,0,0,1,7.8-5.45,22.65,22.65,0,0,1,9.65-2,23.85,23.85,0,0,1,17.45,7.45c4,3.85,6.27,7.65,6.69,11.44Z'%20fill='rgb(35,%2010,%2088)'/%3e%3cpath%20d='M455.61,145.5A37.53,37.53,0,0,0,466,152.11a36.41,36.41,0,0,0,28.76,0,37.1,37.1,0,0,0,11.72-7.94A37,37,0,0,0,506.57,92c-7.11-7.31-15.86-10.9-26.28-10.9a35.54,35.54,0,0,0-24.68,9.52V86h0V52H443.33v99.8h12.28M498,135.49a24.27,24.27,0,0,1-17.66,7.31A24.84,24.84,0,0,1,455.61,118a23.62,23.62,0,0,1,7.24-17.44,23.93,23.93,0,0,1,17.44-7.45,23.2,23.2,0,0,1,9.73,2,26.42,26.42,0,0,1,8,5.45,24.57,24.57,0,0,1-.06,34.89Z'%20fill='rgb(35,%2010,%2088)'/%3e%3cpath%20d='M561.26,81.08a35.56,35.56,0,0,0-24.69,9.52V52H524.3v99.8h12.27V145.5A37.53,37.53,0,0,0,547,152.11a36.41,36.41,0,0,0,28.76,0,37.1,37.1,0,0,0,11.72-7.94A36.94,36.94,0,0,0,587.53,92C580.43,84.67,571.67,81.08,561.26,81.08Zm17.65,54.41a24.27,24.27,0,0,1-17.65,7.31A24.84,24.84,0,0,1,536.57,118a23.62,23.62,0,0,1,7.24-17.44,24,24,0,0,1,17.45-7.45,23.15,23.15,0,0,1,9.72,2,26.59,26.59,0,0,1,8,5.45,24.55,24.55,0,0,1-.07,34.89Z'%20fill='rgb(35,%2010,%2088)'/%3e%3crect%20x='605.26'%20y='51.96'%20width='12.07'%20height='14.46'%20fill='rgb(35,%2010,%2088)'/%3e%3crect%20x='605.26'%20y='76.99'%20width='12.07'%20height='78.08'%20fill='rgb(35,%2010,%2088)'/%3e%3cpath%20d='M698.23,118.25A37,37,0,0,0,687.4,91.91,37,37,0,0,0,624.24,118a36,36,0,0,0,10.82,26.13,37.4,37.4,0,0,0,11.79,7.94,36.46,36.46,0,0,0,14.41,3,35.29,35.29,0,0,0,15.18-3.31c4.68-2.14,9.45-5.85,14.27-11l-9.17-8.34q-9.31,10.33-20.28,10.34a23.84,23.84,0,0,1-17.51-7.31c-4-3.86-6.27-7.65-6.76-11.38h60.48ZM637,112c.49-3.79,2.83-7.59,6.83-11.44a22.94,22.94,0,0,1,7.79-5.45,22.65,22.65,0,0,1,9.65-2,23.84,23.84,0,0,1,17.45,7.45c4,3.85,6.28,7.65,6.69,11.44Z'%20fill='rgb(35,%2010,%2088)'/%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
Trust as infrastructure.
Designed for regulated Nordic organizations. Built around documented controls, clear accountability, and continuous risk management. Debbie’s operational processes and technical architecture are audited and penetration-tested by independent experts.
Audited Annually By
Penetration Tested By
Governance & Compliance
Debbie’s architecture and operations are systematically managed and independently verified to maintain strong security controls for financial data.
ISAE 3000 Type 2
Operational processes and controls are audited annually by PwC, providing independent assurance that our security measures are executed consistently over time.
Structured Security Management
Our information security management, technical architecture, and operational processes are governed through documented policies, risk assessments, and defined responsibilities.
Documented Policies
Comprehensive risk assessments, information security policies, and incident response plans are governed by an appointed Information Security Officer.
Supplier Due Diligence
Strict vetting of all sub-processors, supported by robust Data Processing Agreements (DPAs) and TIA/SCCs for third-country data transfers.
Identity & Access
Control exactly who can see and do what. We enforce strict least privilege principles and enterprise-grade authentication for all workspaces.
Enterprise SSO & MFA
Seamless integration with EntraID and Google Workspace. Multi-factor authentication (MFA) is strictly enforced across all user accounts and environments.
Role-Based Access (RBAC)
Every user is assigned a role in Debbie’s identity and access model, with permissions limited to the data and functions relevant to that user.
Least Privilege Enforcement
Access rights undergo quarterly reviews approved by the CTO. Privileged production access is segregated, and a formal offboarding procedure removes access when employees leave.
Protected Audit Logging
Application logs are centralized in Google Cloud Logging and protected from alteration. Debbie also records who has accessed each debtor case.
Infrastructure & Hosting
A modern, resilient foundation built on Google Cloud Platform with customer data hosted within EU/EEA boundaries.
EU-Based Hosting
All underlying infrastructure and customer data is hosted exclusively within EU/EEA boundaries on Google Cloud Platform (GCP).
Immutable Infrastructure
Production runs on serverless architecture (Cloud Run / App Engine) where code cannot be manually altered without passing through a formal deployment.
Environment Segmentation
Strict network isolation exists between development and production environments. Only standard web ports (443 HTTPS, 80 Redirect) are exposed.
Data at Rest & Transit
AES-256 protects databases and backups in Cloud SQL, while TLS 1.2+ protects data in transit. Google Cloud’s underlying cryptographic modules are FIPS 140-2 validated.
Application Security
Security is embedded directly into our software development lifecycle, supported by continuous automated testing and third-party verification.
Annual Penetration Testing
Comprehensive annual penetration testing is performed by Truesec to proactively identify, classify, and mitigate potential application vulnerabilities.
Secure SDLC
Documented change management applies the four-eyes principle, code review, automated testing, and a formal deployment process to production changes.
Continuous Scanning
Static Application Security Testing (SAST) and continuous dependency scanning automatically block merges containing known vulnerabilities.
API & Payload Security
APIs are protected by revocable tokens and rate limiting. Zero card data is stored; all payments route through regulated external gateways.
Continuity & Endpoints
Operational resilience extending from our cloud infrastructure all the way down to individual employee workstations.
Multi-Zonal Failover
Infrastructure is deployed across multiple Google Cloud availability zones with automatic failover to ensure high uptime and continuous service.
Point-in-Time Backups
Point-in-time recovery provides an RPO below one second with seven-day retention, supplemented by daily backups with up to 30-day retention and immutable, zone-separated backups.
Mobile Device Management
Employee hardware is centrally managed via Jamf Pro. Policies enforce FileVault 2 encryption, automatic device locking, and prohibit local admin rights.
Endpoint Security
Real-time malware protection and Endpoint Detection and Response (EDR) via Jamf Protect, combined with network-level DNS filtering.
Need complete technical details?
Our detailed architecture documentation, data processing agreements, and exact sub-processor lists are available for IT security reviews during procurement.
Request Documentation