Zum Inhalt springen
EU VETTED

Signicat

E-Signatur · Norwegen
Gegründet 2006 · signicat.com

Trondheim-based pan-European eIDAS QTSP for digital identity, e-ID and qualified e-signatures; Nordic Capital-owned, EEA-hosted on US hyperscalers.

Signicat bietet EU-Hosting in Norwegen, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko. Gelistet unter E-Signatur.

Bewertungsnotizen

Signicat AS (Trondheim, Norway; eIDAS Qualified Trust Service Provider; ISO/IEC 27001:2022 + 27018:2019 (DNV) + SOC 2 Type II) is a genuine European identity/trust group with an all-EU/EEA group entity chain and a public DPA + public sub-processors list, but its core platform runs multi-cloud on three US-owned hyperscalers (Google Cloud EMEA/IE, AWS/LU, Microsoft Azure/IE), all with EEA data residency, and Mailchimp (US, USA-stored) is used for some notifications, so despite EEA hosting it carries meaningful CLOUD Act exposure and three US-owned sub-processors, which caps the score at 3/5.

Befund

CLOUD Act
Eigentümer
Unterauftragsverarbeiter
— nicht offengelegt

Geprüfte Signale

Jurisdiktion
  • EU-/Angemessenheits-Hosting: Ja
  • EU-/Angemessenheits-Betreiber: Ja
  • Keine US-CLOUD-Act-Exposition: Nein
Transparenz
  • Öffentlicher AVV: Ja
  • Unterauftragsverarbeiter offengelegt: Ja
  • Open-Source-Clients: Nein
  • Zertifizierung durch Dritte: Ja
Springen zu

Über Signicat

Signicat is a Trondheim (Norway) headquartered pan-European digital-identity and electronic-trust platform, describing itself as "the leading provider of digital identity solutions in Europe" with 21,000+ companies served and 500+ staff across Norway, Sweden, Finland, Denmark, the Netherlands, Germany, UK, Spain, Portugal, Romania, Lithuania, Estonia and Latvia. It is a registered eIDAS Qualified Trust Service Provider (QTSP) and one of the first certified under eIDAS 2.0, with qualified services spread across jurisdictions: qualified time-stamps (Norway, via Buypass/SK ID), qualified certificates and remote signature-creation device management (Spain, via UANATACA/ACCV) and qualified signature/seal validation (Lithuania, via the 2021-acquired Dokobit). Beyond e-signing it covers bank-grade e-ID authentication (BankID, MitID, iDIN, itsme), onboarding/KYC, and fraud/identity verification (bolstered by the Sphonic and Inverid acquisitions). Ownership is the key nuance: since April 2019 Signicat has been majority-owned by Nordic Capital (a European private-equity investor, via Fund IX), acquired from Secure Identity Holding and Viking Venture III; Viking Venture III re-invested and remains a Norwegian minority shareholder alongside employee shareholders. There is no US-VC control and no US parent, but Nordic Capital is a PE firm whose funds use Jersey/Luxembourg structures, so this is "other" rather than a clean local-hero "eu_owned" tag. Compliance posture is strong on paper: ISO/IEC 27001:2022, ISO/IEC 27018:2019 (DNV-verified), SOC 2 Type II, OpenID Certified, plus ENS High and Cyber Essentials Plus, with a GDPR-aligned DPA and a public sub-processors appendix, and eIDAS QTSP status. The caveat for sovereignty-focused buyers is infrastructure: the platform is multi-cloud across Google Cloud, AWS and Microsoft Azure (all EEA regions) plus T-Systems and Orange Business, three US-owned hyperscalers at rest, which drives CLOUD Act exposure to "material" despite EEA data residency. Best fit: regulated EU enterprises (banking, insurance, public sector) needing broad national e-ID coverage and qualified signing under one contract; buyers who weight US-infrastructure exclusion above feature breadth will not find a clean answer among the qualified providers here, because Youtrust, Universign and Signaturit all now carry US-owned cloud in the at-rest path; the closest option in this category is Skribble, whose signed documents stay with Swiss and German providers.

Unterauftragsverarbeiter-Karte · nicht offengelegt

Anbieter veröffentlicht keine Liste der Unterauftragsverarbeiter. Schrems-II-Konformität und CLOUD-Act-Risiko lassen sich ohne sie nicht unabhängig prüfen.

Rahmenwerke & Zertifizierungen

ISO/IEC 27001
Aktiv
ISO/IEC 27018
Aktiv
SOC 2
Aktiv
Hinweis · US-Rahmenwerk

Funktionsmatrix

Tabelle 1Funktionen von Signicat

Qualifizierte Signatur (QES) Ja
Fortgeschrittene Signatur (AES) Ja
Audit-Trail Ja
Identitätsprüfung Ja
API / Webhooks Ja

Integration & Zugriff

REST API Ja
SSO (SAML / OIDC) Ja

Compliance & Governance

Audit log Ja
Self-host / on-prem option Nein

Preise & Tarife

Individuelle Preise

Kontaktieren Sie den Anbieter für Staffel- oder Mengenpreise.

Preisseite ansehen

Öffentliche Dokumente

  • Auftragsverarbeitungsvertrag (AVV)
    developer.signicat.com/terms…
    Öffnen
  • Liste der Unterauftragsverarbeiter
    developer.signicat.com/terms…
    Öffnen
  • Nutzungsbedingungen
    developer.signicat.com/terms…
    Öffnen

Alternativen in dieser Kategorie

  • Eversign (Xodo Sign)
    Österreich · 10 $/Mt.
    US-verbunden
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • Signaturit (Namirial)
    Spanien
    EU-gehostet
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • Skribble
    Schweiz · 23 €/Mt.
    EU-ansässig
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
Alle e-signatur-Alternativen ansehen