Security

The services run on Microsoft Azure. Databases and files are stored in Azure and encrypted at rest. All traffic between your browser and the services uses HTTPS, and browsers are instructed never to use an unencrypted connection (HSTS).

Secrets such as keys and passwords for subprocessors are kept in Azure Key Vault, not in source code.

Privat and Proff share one sign-in. You can sign in with email and password, Vipps or Google, and you can turn on two-factor authentication with an authenticator app.

All API endpoints require sign-in unless they are deliberately public, such as address search and calculations in the open energy plan. Access is role-based, and administrative functions require the administrator role. Sessions can be revoked, and sign-in is rate limited against repeated attempts.

We log security events and changes so that we can detect misuse and fix errors. Personal data such as names, email addresses, phone numbers and addresses is masked before requests are logged, and IP addresses are stored pseudonymized or as an approximate location.

How long logs are kept is described in the privacy policy.

Some features use AI models, including analysis of floor plans and documents. Content is only sent when you use the feature, and we do not allow the data to be used to train the providers' general models. The providers we use are listed in the privacy policy.

We use a limited set of subprocessors for hosting, email, payments, analytics and AI. The list and their purposes are in the privacy policy. Business customers can request a complete list including storage locations.

If you have found a possible vulnerability, we want to hear from you. Send a description to info@gadder.no with the subject “Security”, ideally including the steps needed to reproduce it. Machine-readable contact details are in /.well-known/security.txt.

Please do not access, change or delete other people's data, do not disrupt the service, and give us reasonable time to fix the issue before disclosing it publicly. We will confirm that we have received your report and keep you updated.

In the event of a personal data breach, we notify the Norwegian Data Protection Authority within 72 hours where required, and affected customers and users without undue delay.

If your organization uses Proff, we can enter into a data processing agreement and answer supplier and security assessments. Contact us at info@gadder.no.