Summerbase

Information Security Policy

Last updated: October 22, 2026

Summerbase ApS protects the confidentiality, integrity and availability of customer data and company systems through the controls set out in its security policies, published at summerbase.com/policies.

Purpose

This is the top-level policy. It sets management’s commitment to security and points to the detailed policies that implement it.

Scope

All employees, contractors, systems, GCP projects (EU and US regions), SaaS tools and data owned or processed by Summerbase.

Policy

  1. Management commitment. The CEO approves the information security program and reviews its status at least once a year with the Security Officer.
  2. Security objectives. The company maintains: no unauthorized access to customer data; a production service designed for high availability, monitored continuously, and recoverable as set out in the Business Continuity and Disaster Recovery Plan; and compliance with GDPR and customer contracts.
  3. Framework. Security is managed through the security policies published at summerbase.com/policies. Each has a named owner and is reviewed at least yearly.
  4. Risk-based approach. Controls are chosen and prioritized based on the annual risk assessment (Risk Management Policy).
  5. Legal and contractual requirements. The company identifies and meets applicable laws, including GDPR, the Danish Data Protection Act (databeskyttelsesloven) and the Danish Bookkeeping Act, and customer contract terms. Data residency commitments (EU or US region) are honored as agreed with each customer.
  6. Awareness. All personnel complete security awareness training at hire and yearly (Human Resource Security Policy).
  7. Monitoring and improvement. The Security Officer tracks control effectiveness, audit findings and incidents, and reports to the CEO.
  8. Communication. Policies are published at summerbase.com/policies. Material changes are communicated to all personnel, and customers are informed of relevant changes through the public security page.

Roles

See the Information Security Roles and Responsibilities policy for who owns what.

Exceptions, enforcement and review

These rules apply to every Summerbase security policy.

  • Exceptions. Exceptions to any policy must be requested in writing, approved by the Security Officer, logged with a reason and expiry date, and reviewed at least yearly.
  • Enforcement. Violations may lead to disciplinary action, up to termination of employment or contract, in line with Danish employment law.
  • Review. Each policy is reviewed at least yearly, and after any material change to the business or infrastructure.