Nantes-based French customer-messaging platform (Crisp IM SAS, founded 2015); fully bootstrapped, no VC, 200k+ customers, flat-rate pricing.
- FROM
- —
- CLOUD ACT
- MATERIAL
Zusammenfassung aus Eigentümerschaft und CLOUD-Act-Risiko.
Oslo-based Norwegian ITSM / servicedesk (Pureservice AS, founded 2008, Syscom demerger 2018); Swedish-PE-owned (Pamir, 2024); runs on Microsoft Azure Norway.
Pureservice aus der Kategorie Helpdesk bietet EU-Hosting mit Norway als Hosting-Standort, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko.
Pureservice AS (Oslo, Norway; org.nr 929 782 216; founded 2008, demerged from Syscom in 2018, fully independent from June 2020) is a Norwegian/Scandinavian ITSM / Enterprise Service Management servicedesk used by 450+ organisations including municipalities, health trusts, energy companies and universities. Majority-owned since December 2024 by Pamir Partners AB (Stockholm), a Swedish lower-mid-market software PE firm — no US ownership on the cap table. Disclosure is strong for the category: a publicly downloadable combined service/licence/DPA agreement (v2.6) and a public named sub-processor list. The decisive caveat is infrastructure: the marketing claim that 'data is stored securely in Norway' is technically true but resolves to Microsoft Azure's Norway East region (Oslo) — data resides in the EEA but at rest on US-owned Microsoft hardware, so CLOUD Act exposure is material, not none. ISO 27001:2013 and SOC 2 Type 2 are held by the Azure datacenter, NOT by Pureservice itself — so certifications is left empty. The sub-processor list adds further US dependencies: Microsoft Azure (host), Mailgun, DNSimple, Sentry.io and UserGuiding are all US-operated; only Domeneshop is Norwegian. Net: EEA-incorporated and EEA-resident data with a clean Nordic owner, but the entire stack runs on a US hyperscaler plus several US SaaS sub-processors → compliance_score 3.
Wie stark Kundendaten US-Behörden nach dem CLOUD Act ausgesetzt sind.
Wo die letztliche Kontrolle über das Betreiberunternehmen liegt.
Pureservice is an Oslo-headquartered Norwegian IT and Enterprise Service Management platform operated by Pureservice AS (org.nr 929 782 216). It was founded in 2008 inside the Norwegian IT-consultancy Syscom (now DXC Technology Norge), spun out as a separate company through a 2018 demerger, and has operated fully independently from its own Egertorget offices in central Oslo since June 2020. The product is a fixed-price, all-inclusive servicedesk: self-service portal, ticketing, workflow automation, asset/CMDB management, AI assistance, dashboards and integrations, serving IT, HR and Finance teams. Pureservice reports 3.5 million end-users, 25,000 case managers and 450+ customer organisations — heavily weighted toward the Norwegian public sector (municipalities, health trusts, universities, energy utilities).
Ownership is a clean Nordic story. In December 2024 Pamir Partners AB — a Stockholm-based private-equity firm (founded 2011) specialising in small and mid-sized European software companies — acquired a majority stake from the private owners after a Nordhaven-run sale process (the business was marketed on ~NOK 48m ARR / ~NOK 20m EBITDA). There is no US investor on the cap table: the company is Norwegian (EEA, not EU), now controlled by a Swedish software PE house. Because Norway sits in the EEA rather than the EU and the controlling owner is Swedish, the ownership_signal is recorded as other rather than eu_owned.
For an EU/EEA-sovereignty audit the infrastructure layer is where the "local hero" framing breaks down. Pureservice repeatedly markets that customer data is stored "securely in Norway" (Swedish customers in Sweden), and that is literally true — but the hosting platform is Microsoft Azure: Norwegian data sits in the Azure Norway East region (Oslo), Swedish data in Azure Sweden. The data therefore stays inside the EEA and never leaves it, but it lives at rest on infrastructure owned by US-incorporated Microsoft, which keeps CLOUD Act exposure at material. The ISO 27001:2013 and SOC 2 Type 2 certifications cited on Pureservice's trust pages belong to the Azure datacenter, not to Pureservice as an entity — so this listing carries no vendor-held certification token. The public sub-processor list names Microsoft Azure (host), Mailgun (email), DNSimple, Sentry.io and UserGuiding (all US-operated) plus Domeneshop (NO) and Manula — a typical US-SaaS-heavy supporting stack. On the positive side, disclosure is genuinely good: a publicly downloadable combined service/licence/DPA agreement, a public sub-processor list, encryption at rest and in transit, OWASP Top 10 alignment and annual third-party pen-testing. Best fit: Norwegian and Scandinavian public-sector and mid-market IT teams that want a Nordic-owned, Norwegian-data-resident servicedesk and accept Microsoft Azure as the underlying platform. Buyers requiring zero US-hyperscaler / zero-CLOUD-Act infrastructure should treat the "data in Norway" claim as data-residency, not data-sovereignty.
Nantes-based French customer-messaging platform (Crisp IM SAS, founded 2015); fully bootstrapped, no VC, 200k+ customers, flat-rate pricing.
Cologne-based German live-chat platform (Userlike UG, founded 2011); acquired by Swedish Lime Technologies AB (Nasdaq Stockholm-listed).
Wrocław-based Polish customer-service suite (Text S.A., WSE-listed since 2014), 28k+ customers in 150+ countries; LiveChat + ChatBot + HelpDesk.