Isolation between organisations
Shows that unauthenticated requests are blocked, tampered sign-in tokens are rejected, and signed-in users cannot reach other organisations’ rooms or data.
Download PDF : Isolation between organisations(9 kB)Security and compliance
How we protect your data
This page describes how Eurion is operated and protected today, what we have tested, and what is still in progress.
Hosting and jurisdiction
Eurion is built and operated by a Swedish business. In Eurion Cloud all customer data is stored in the EU.
The platform is built on established open-source components such as PostgreSQL, Apache Kafka, MinIO and Meilisearch. It does not depend on any single cloud provider.
If you would rather not rely on us as the operator, you can install Eurion in your own environment. Installation works with no internet connection at all.
AI features use language models that run on the platform. No content is sent to outside AI services.
Encryption
All traffic to and from Eurion is encrypted with TLS. Our sites use HSTS, so browsers never connect unencrypted.
We are building end-to-end encryption for chat based on the MLS standard (RFC 9420). It is not enabled by default yet. We will update this page when it is.
Access and isolation
- Sign-in with SAML or OpenID Connect against your existing directory, and two-factor authentication.
- Each organisation is logically separated. Every request is checked against the user’s organisation and permissions.
- Administrative events are recorded in an audit log.
Test reports
The reports come from automated tests run against the production environment.
Erasure under GDPR Article 17
Shows the whole erasure flow: request, review, anonymisation and deletion across every service that stores personal data.
Download PDF : Erasure under GDPR Article 17(14 kB)GDPR, NIS2 and ISO 27001
GDPR
Eurion is designed to minimise personal data and can erase a user’s data across every service. We sign a data processing agreement under Article 28 with each customer. The list of sub-processors is part of that agreement.
NIS2
The platform supports the requirements NIS2 places on customers: access control, logging and traceability. System status and incidents are published openly.
ISO/IEC 27001
Work towards ISO/IEC 27001 has started. Eurion is not certified today.
System status
Current status and past incidents for every Eurion service.
Report a vulnerability
Found a security issue in Eurion? Send a description to security@eurion.se. Contact details are also in our security.txt.
Describe what you found and how to reproduce it. Only test against accounts you own, and avoid affecting other users or availability. We will not take legal action against anyone reporting in good faith under these terms.