Trust & jurisdiction
A vendor register holds sensitive information about your business relationships. Where the operator stands, and whose laws reach them, is part of the product. Here are the verifiable facts — no certification theatre.
Operated by a Norwegian company
PrivyLedger is built and operated by Vassbrekke AS, org.nr 835 834 212, Norway. Governance, contracts, and operations sit under Norwegian and EEA law — the same law that governs your GDPR obligations.
Your register data stays on our infrastructure in Norway/EEA
The application, database, and backups run on infrastructure we operate in Norway/EEA. Register data is not replicated to, processed by, or accessible to any non-EEA party as part of the service.
No international transfers of register data
Because operator and infrastructure are both in the EEA, core processing is EEA→EEA by construction. The only third-party processor touching anything is Stripe for payments (billing IDs only) — full list and transfer bases are published.
See sub-processors →No analytics SDKs, no trackers, no ad tech
The product ships without third-party analytics scripts or telemetry. Your workspace usage is not profiled, and vendor records are never used to train any model.
Why this matters more than 'EU regions'
US surveillance law (CLOUD Act, FISA 702) follows provider control, not server location — an EU data centre run by a US company does not remove that exposure, as EU regulators have repeatedly stated. Choosing a provider already under EEA jurisdiction removes the question instead of managing it.
Read our security measures →For your own audits
When your customers ask you who processes your data, the same discipline applies. Our Article 28 DPA, sub-processor list, and security documentation are public so you can answer without asking us:
We state facts we can evidence: legal entity and registry number, hosting jurisdiction, processor list, and published security review. We do not claim certifications we do not hold (no SOC 2 / ISO claims). Questions: contact per the privacy policy or security.txt.