Vendor profile
Secure Practice: where is customer data stored and processed?
Secure Practice stores customer data on cloud servers in the EU/EEA, with Norway named as one location on the vendor's trust page, though the storage period is not stated there. Microsoft Ireland operates the data centre and infrastructure, and the data processing agreement, last updated 12 October 2022, requires processing and storage within the EU/EEA without approval for third countries. The customer group is not stated, and the product name and owner are not given. SMS delivery goes through ONLINECITY.IO ApS and e-mail gateways for phishing simulations and service mail through IT-Sjefen AS in Norway, with the latter only forwarding data in transit.
Checked 13 October 2026 · based on the vendor's own public documents
See the map and sources
Where data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|
| Storage | Norway, Europe (country not stated) | – |
|---|
| Processing | Europe (country not stated) | – |
|---|
| Logs and telemetry | Europe (country not stated) | – |
|---|
| Analytics and metadata | Europe (country not stated) | – |
|---|
| Notifications and email | Europe (country not stated), Norway | – |
|---|
Ownership and agreements
| Headquarters | Norway |
|---|
| Data processing agreement | Found and read |
|---|
| Certifications | None found |
|---|
Sub-processors (3)
| Name | Country | Purpose |
|---|
| Microsoft Ireland Operations, Ltd. | EU/EØS | Data center and infrastructure for our cloud services, various internal systems |
| ONLINECITY.IO ApS | EU/EØS | SMS gateway for one time passcodes, user notifications/communications. |
| IT-Sjefen AS | Norway | Email gateways for simulated phishing and service emails. Landing and debriefing |
Sources