Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Intility

VERIFIED
Cloud & hosting · Norway
Founded 2000 · intility.com ↗

Norwegian managed enterprise-cloud platform (est. 2000), own platform colocated in Oslo, NO/SE data residency, ISO 27001 + ISAE 3402/3000; enterprise quote-based, no public pricing.

In short

Intility, in the Cloud & hosting category, offers EU hosting with Norway as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Intility AS (org. nr 981 967 070, Schweigaards gate 39, Oslo) is a Norwegian-controlled managed enterprise-cloud platform that runs its OWN platform on colocated hardware (Bulk Data Centers, OS-IX Oslo) with all platform data stored and processed within Norwegian and Swedish borders and operated by NO/SE staff — a genuine local operator, not a US-hyperscaler reseller. It is ISO 27001 certified (audited April 2025 by Scandinavian Certification AS, covering all service deliveries) and additionally publishes ISAE 3402 Type 2 (security) and ISAE 3000 Type 2 (GDPR) reports. It is capped at 3/5 because: (1) the flagship product is a multicloud managed platform that routinely integrates Microsoft 365 / Azure and other public cloud for customers, introducing material US CLOUD Act exposure outside the dedicated 'Sovereign Cloud' SKU; (2) there is no publicly self-servable DPA — processing is governed by per-customer agreements available only on contract, and the public sub-processor list (Fathom, Hotjar, Questback, Teamtailor, WhistleB) covers only the corporate website, not the customer platform; (3) Norway is EEA but outside the EU, and no EUCS / C5 / SecNumCloud attestation exists. The clean local-hero posture applies to the Sovereign Cloud offering specifically; the default platform is multicloud.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Intility

Intility AS is a Norwegian managed enterprise-cloud and digital-workplace provider founded in 2000, headquartered at Schweigaards gate 39, 0191 Oslo (org. nr 981 967 070), serving roughly 700 companies across 3,000+ locations in Norway and the wider Nordics. Unlike a self-service IaaS, Intility sells a fully-managed "complete platform for multicloud IT environments": it operates its own platform on colocated infrastructure (Bulk Data Centers' OS-IX facility in Oslo, with Swedish presence), wrapping compute, networking, managed Kubernetes, managed databases, identity/SSO, security and an end-user digital workplace into one operated service. This is a real local operator running its own stack — not a thin reseller of a US hyperscaler.

For sovereignty-minded buyers the key distinction is between Intility's dedicated Sovereign Cloud SKU and its default multicloud platform. The Sovereign Cloud keeps all data stored and processed strictly within Norwegian and Swedish jurisdiction, operated and supported exclusively by NO/SE personnel, and can be locked to a single country — a genuinely clean posture for finance, healthcare, energy and public-sector workloads. The mainstream Intility platform, by contrast, is explicitly multicloud and commonly integrates Microsoft 365 / Azure and other public cloud at the customer's election, which carries material US CLOUD Act exposure for any data that lands there. Buyers must therefore specify the sovereign offering to get the local-only guarantees.

Compliance evidence is solid on attestation but weak on self-serviceability: Intility holds ISO 27001 (certified April 2025 by Scandinavian Certification AS, scope = all service deliveries, only "outsourced development" excluded) and publishes ISAE 3402 Type 2 (information security) and ISAE 3000 Type 2 (GDPR) reports. However, the DPA is not publicly available — processing is governed by separate per-customer data-processing agreements — and the only public sub-processor list covers the corporate marketing website (Fathom Analytics, Hotjar, Questback, Teamtailor, WhistleB), not the customer platform. Ownership is Norwegian-led with minority Nordic/UK venture backing (Northzone, Melesio; linked via the Amphytron vehicle of Bjørn Stray and Arild Engh); no US private-equity or US controlling stake is evident. Pricing is enterprise and quote-based with no public EUR list. Best fit: Nordic enterprises and public bodies that want a single managed sovereign platform and will contract the Sovereign Cloud SKU explicitly.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
FEATURES

Capability matrix

Dedicated / bare-metal No
Object storage (S3) No
Managed Kubernetes Yes
Managed databases Yes
GPU instances No
Hourly billing No
API / Terraform No
Countries 2 countries
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option Yes
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement — this is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    intility.com/privacy-policy…
    Open ↗
ALTERNATIVES

Alternatives in this category

Aruba Cloud
Italy · Founded 1994
EU-SOVEREIGN

Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.

Public DPA Sub-processors Open source
FROM
€1/mo
CLOUD ACT
NONE
Cleura
Sweden · Founded 2005
EU-SOVEREIGN

Swedish OpenStack public + compliant cloud (Cleura, ex-City Network, Iver-owned), ISO 27001/27017/27018, EU-only residency.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE
Clever Cloud
France · Founded 2010
EU-SOVEREIGN

French sovereign PaaS/IaaS: deploy apps and managed databases on EU infrastructure, billed per second.

Public DPA Sub-processors Open source
FROM
€4.8/mo
CLOUD ACT
NONE