Intility
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian managed enterprise-cloud platform (est. 2000), own platform colocated in Oslo, NO/SE data residency, ISO 27001 + ISAE 3402/3000; enterprise quote-based, no public pricing.
Intility offers EU hosting in Norway, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Intility AS (org. nr 981 967 070, Schweigaards gate 39, Oslo) is a Norwegian-controlled managed enterprise-cloud platform that runs its OWN platform on colocated hardware (Bulk Data Centers, OS-IX Oslo) with all platform data stored and processed within Norwegian and Swedish borders and operated by NO/SE staff, a genuine local operator, not a US-hyperscaler reseller. It is ISO 27001 certified (audited April 2025 by Scandinavian Certification AS, covering all service deliveries) and additionally publishes ISAE 3402 Type 2 (security) and ISAE 3000 Type 2 (GDPR) reports. It is capped at 3/5 because: (1) the flagship product is a multicloud managed platform that routinely integrates Microsoft 365 / Azure and other public cloud for customers, introducing material US CLOUD Act exposure outside the dedicated 'Sovereign Cloud' SKU; (2) there is no publicly self-servable DPA: processing is governed by per-customer agreements available only on contract, and the public sub-processor list (Fathom, Hotjar, Questback, Teamtailor, WhistleB) covers only the corporate website, not the customer platform; (3) Norway is EEA but outside the EU, and no EUCS / C5 / SecNumCloud attestation exists. The clean local-hero posture applies to the Sovereign Cloud offering specifically; the default platform is multicloud.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Intility
Intility AS is a Norwegian managed enterprise-cloud and digital-workplace provider founded in 2000, headquartered at Schweigaards gate 39, 0191 Oslo (org. nr 981 967 070), serving roughly 700 companies across 3,000+ locations in Norway and the wider Nordics. Unlike a self-service IaaS, Intility sells a fully-managed "complete platform for multicloud IT environments": it operates its own platform on colocated infrastructure (Bulk Data Centers' OS-IX facility in Oslo, with Swedish presence), wrapping compute, networking, managed Kubernetes, managed databases, identity/SSO, security and an end-user digital workplace into one operated service. This is a real local operator running its own stack, not a thin reseller of a US hyperscaler.
For sovereignty-minded buyers the key distinction is between Intility's dedicated Sovereign Cloud SKU and its default multicloud platform. The Sovereign Cloud keeps all data stored and processed strictly within Norwegian and Swedish jurisdiction, operated and supported exclusively by NO/SE personnel, and can be locked to a single country, a genuinely clean posture for finance, healthcare, energy and public-sector workloads. The mainstream Intility platform, by contrast, is explicitly multicloud and commonly integrates Microsoft 365 / Azure and other public cloud at the customer's election, which carries material US CLOUD Act exposure for any data that lands there. Buyers must therefore specify the sovereign offering to get the local-only guarantees.
Compliance evidence is solid on attestation but weak on self-serviceability: Intility holds ISO 27001 (certified April 2025 by Scandinavian Certification AS, scope = all service deliveries, only "outsourced development" excluded) and publishes ISAE 3402 Type 2 (information security) and ISAE 3000 Type 2 (GDPR) reports. However, the DPA is not publicly available (processing is governed by separate per-customer data-processing agreements), and the only public sub-processor list covers the corporate marketing website (Fathom Analytics, Hotjar, Questback, Teamtailor, WhistleB), not the customer platform. Ownership is Norwegian-led with minority Nordic/UK venture backing (Northzone, Melesio; linked via the Amphytron vehicle of Bjørn Stray and Arild Engh); no US private-equity or US controlling stake is evident. Pricing is enterprise and quote-based with no public EUR list. Best fit: Nordic enterprises and public bodies that want a single managed sovereign platform and will contract the Sovereign Cloud SKU explicitly.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Intility
Integration & access
Compliance & governance
Public documents
-
missingData Processing Addendum (DPA)— missing
-
OpenSub-processors listintility.com/privacy-policy…
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |