1. Priva's security approach
We don't treat security as a one-time activity. It is an ongoing process that evolves alongside risks, technologies and regulations. Our approach is based on:
- a risk-based methodology
- security by design
- continuous improvement
2. Governance, standards & compliance
Our approach is grounded in internationally recognised standards. We work with an organisation-wide Information Security Management System aligned with ISO/IEC 27001, and we follow ISO 9001 for quality management. We also align with GDPR, the NIS2 Directive, IEC 62443 and the Cyber Resilience Act (CRA).
3. Architecture & system design
Security is part of our products from day one. We separate Information Technology (IT) from Operational Technology (OT) and build systems in layers, following the defence-in-depth principle.
3.1 The Priva Edge Gateway
The Priva Edge Gateway is a controlled interface between on-site systems and the cloud. Communication always starts from within the system and is limited to the data that is needed. This keeps critical systems from being directly exposed to the internet.
4. Product & cloud security
Our cloud services run on Microsoft Azure, a secure and reliable foundation. On top of that, we add our own controls: secure development, risk assessments, automated and manual testing, and regular external penetration tests. Security continues after deployment, with firmware updates managed through the Priva Cloud.
5. Data security & access
5.1 Encryption and access control
Sensitive data is encrypted, both when it is stored and when it is sent. Access is based on least privilege and need-to-know, and multi-factor authentication (MFA) protects users and administrators.
5.2 Who owns the data?
Data ownership always stays with the customer. Read the whitepaper to find out where your data is stored and how it is protected.
6. Monitoring, incident response & operations
Continuous monitoring helps us detect unusual behaviour early. If an incident happens, structured procedures ensure a fast, coordinated response. Where applicable, we also provide customers with the technical information they need for their NIS2 reporting obligations.
7. Business continuity & resilience
Redundant components, regular backups and tested recovery procedures help keep operations running and restore them quickly after a disruption.
8. Roles & responsibilities
Cybersecurity is a shared responsibility:
- Priva secures its products, platform and cloud services.
- Priva Partners are certified to implement, configure and maintain Priva systems.
- Customers define their security requirements and oversee how systems are used.
The whitepaper sets out what each party is responsible for.
What this means for Priva Partners
The way systems are installed, configured and maintained determines how effective security remains over time. The whitepaper explains what we expect from Priva Partners and how we support them. It also answers common questions about NIS2 and the CRA.
