Certified. Audited. Accountable.

ISO/IEC 27001:2022

Our information security management system is certified to ISO/IEC 27001:2022 — the international standard for managing information security — by C1 Certification AB, Stockholm, a certification body accredited by SWEDAC (accreditation no. 10432, ISO/IEC 17021-1). The certificate was issued on 27 May 2026 after a full audit of the management system against the standard and our Statement of Applicability, and is maintained through annual surveillance audits.

Scope. Development, operation, management and supply of cloud-based platform, with services for data visualisation, analysis and graph-based solutions — that is, the whole of PRISM Analytics, from the code we write to the environments we run it in and the data we deliver through it.

What the certification means for our customers

Certification is a statement about how the company works, not only about one system. An ISO 27001 management system requires that risks to information are identified and treated, that controls are chosen deliberately and documented in a Statement of Applicability, that people are trained and access is governed, that suppliers are assessed, that incidents are handled and learned from, and that all of this is reviewed by management and audited by an independent body. For a customer who entrusts PRISM with national registers, case data or a commercial business universe, it means the controls they would ask about in a security questionnaire are already in place, independently verified, and kept that way.

Data protection

Cloud Explorers processes personal data under the General Data Protection Regulation (GDPR) as implemented in Norway and Sweden, with Datatilsynet and Integritetsskyddsmyndigheten (IMY) as the supervisory authorities. For customer data in PRISM we act as data processor under a data processing agreement; what the platform may hold, who may see it and for what purpose is decided by the customer as controller and enforced in PRISM Identity. Our own handling of personal data on this site is described in the privacy policy.

Principles built into the platform

Traceability. Every record shows its source and date; every export is recorded against the case it was made for, with a stated purpose, and can be found again by the people responsible for oversight.

Separation. Data from different sources and different customers is kept apart by design and is never combined unless the customer has the legal basis to do so and chooses to.

Identity and access. PRISM Identity federates to the customer's own directory; the directory decides who, PRISM decides what, and every access decision is scoped, audited and reversible.

Deployment choice. The same software runs as SaaS operated by Cloud Explorers, in a managed environment with a partner, or fully on-premises inside the customer's perimeter — so the customer decides where the data lives and who holds the keys.

Trademarks

The product names are protected. PRISM ANALYTICS and PRISM Graph are registered European Union trade marks (EUIPO), held by the group's Norwegian company, Cloud Explorers AS. Customers and partners can rely on the names they contract for; use of the marks by others requires written permission — see the Terms of Use.

Responsible disclosure

If you believe you have found a security vulnerability in PRISM or in any Cloud Explorers service, please write to info@cloudexplorers.com with "Security" in the subject line. We acknowledge reports promptly, keep the reporter informed, and ask that details are not published before a fix is in place.