Skip to main content
FromNine
Menu

Trust and compliance

Trust and compliance for regulated organisations

FromNine is ISO/IEC 27001 certified. This page sets out how we protect your systems and data as a supplier, what we contribute to your obligations under NIS2, DORA and the EU AI Act, and how to request our security documentation.

For public institutions and regulated companies across Europe, where national supervisors add their own requirements to the EU rules.

Request security documentationWhat we commit to

Our commitments

Five commitments in every engagement

Public institutions and regulated companies trust us with sensitive data and with systems that support real decisions. This is what they can hold us to.

  • Information security management

    Certified

    Our information security management system is certified to ISO/IEC 27001, the international standard for managing information security. Controls, supplier management and incident handling follow that system in every engagement.

    Access to your systems and data is agreed before work starts, limited to what the work needs and reviewed when the team changes.

    ISO/IEC 27001 certified

  • Personal data and GDPR

    How we work

    Purposes, access boundaries and retention are agreed before we build. Where we process personal data on your behalf, we act as your processor under a data processing agreement, as Article 28 of the GDPR requires.

    Where processing is likely to result in a high risk, we supply the technical input for your data protection impact assessment.

  • Human oversight of AI

    How we work

    Each AI use case is classified with you during discovery. Approval steps, logging and technical documentation are built into the system from the first release, not added before an audit. Agents work with bounded permissions and ask for approval before steps with consequences.

  • Accessibility

    How we work

    We design and test interfaces against EN 301 549 and WCAG 2.2 level AA, with automated checks and manual review using assistive technology, and deliver a conformance report that lists any known issues.

  • EU data residency

    Per engagement

    Hosting regions, encryption key control and support access locations are decided with you before we build and written into the architecture, including sovereign options where your requirements call for them.

This page describes how we work as a supplier. It is not a statement of compliance on your behalf: which obligations apply depends on your organisation and your use case, and the legal assessment stays with your counsel.

NIS2

NIS2: supporting your supply-chain security

The NIS2 Directive, Directive (EU) 2022/2555, requires essential and important entities to manage the cybersecurity risks to their network and information systems. Supply-chain security is one of the minimum measures in Article 21(2), and Article 21(3) asks entities to take the security practices of their direct suppliers and service providers into account.

As your supplier, we make that part of your duty easier to evidence. Security clauses, incident channels and vulnerability handling are agreed per contract, and the controls that apply to your engagement are documented so your supplier risk process can assess them. Whether and how national NIS2 rules apply to your organisation remains your own assessment.

  • Security clauses in the contract

    Access, subcontracting, incident notification and cooperation with audits are agreed in writing, not assumed.

  • An incident channel that works

    Named contacts and agreed timelines, so an incident on our side reaches you in time for the early warning NIS2 expects within 24 hours (Article 23(4)).

  • Vulnerability handling

    Dependency, code and infrastructure scans run in the delivery pipeline, and findings are fixed or reported through the agreed channel.

  • Evidence on request

    Our ISO/IEC 27001 certificate and a description of the controls that apply to your engagement.

DORA

DORA: ICT third-party risk for financial entities

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Banks, insurers, investment firms, payment institutions and other financial entities must manage ICT third-party risk within their ICT risk management framework, keep a register of information on all contractual arrangements for ICT services (Article 28) and include key contractual provisions in those contracts (Article 30).

When we provide ICT services to a financial entity, we agree the provisions Article 30 lists: a complete description of the services, the locations where they are provided and where data is processed, assistance when an ICT incident occurs, cooperation with your competent authorities and termination rights. For services that support critical or important functions, the contract also covers exit strategies and our participation in your resilience testing.

We supply the information your register of information needs, and we document exit plans from the start so that switching remains a realistic option.

EU AI Act

EU AI Act: human oversight and documentation by design

The AI Act, Regulation (EU) 2024/1689, applies in stages. Prohibited practices and AI literacy have applied since February 2025, and the transparency obligations of Article 50 since August 2026. As amended in 2026 by Regulation (EU) 2026/1744, the rules for high-risk systems listed in Annex III apply from 2 December 2027.

For high-risk systems the Act asks for technical documentation (Article 11), automatic logging (Article 12) and a design that people can effectively oversee (Article 14), and deployers must assign that oversight to people with the competence and authority to act (Article 26). We build for this from the first release: approval steps and the ability to override sit where decisions affect people, and the documentation is written alongside the code.

Whether your organisation acts as provider or deployer depends on how the system is put into service. That question is part of the legal assessment, which stays with your counsel; we supply the technical facts it needs.

In delivery

Security in every stage of delivery

Compliance evidence comes from how the work is done, not from a document written at the end.

  • Least-privilege access

    Access to your environments and data is limited to what the work needs, agreed before work starts and reviewed whenever the team changes.

  • Reviewed and scanned changes

    Changes are peer-reviewed before they ship. Dependency, code and infrastructure scans run automatically, and security testing is planned per release.

  • Incidents handled to an agreed process

    Incident classification, notification contacts and evidence collection are agreed at the start, and built into the incident process where NIS2 or DORA apply to you.

  • Documented handover and exit

    Runbooks, architecture decisions and data models are handed over with the system, and exit plans keep data return and switching costs visible from the start.

Due diligence

Request our security documentation

Procurement, security and legal teams need evidence before a contract is signed. Ask us for our ISO/IEC 27001 certificate and its scope, for answers to your supplier security questionnaire and for the data processing terms that would apply to your engagement.

Send your request through the contact page and mention the framework you assess suppliers against, such as NIS2, DORA or a national security baseline. The right people will get back to you.

  • Contact usMention security documentation in your message.
  • Legal noticeCompany and registration details for your supplier records.

International

One EU baseline, national supervisors

GDPR, DORA and the AI Act are regulations that apply directly across the Union. NIS2 is a directive, so scope, registration and reporting details differ per Member State, and transposition is not yet complete everywhere. Supervision is national in every case: cybersecurity authorities for NIS2, financial supervisors for DORA and data protection authorities for GDPR. For programmes that span several countries, we agree one set of controls and map each incident channel to the authority the entity concerned reports to.

Questions from procurement and security teams

Is FromNine ISO/IEC 27001 certified?

Yes. Our information security management system is certified to ISO/IEC 27001. We share the certificate and its scope on request, as part of your due diligence.

How do you support our NIS2 obligations as a supplier?

We agree security clauses, incident notification channels and vulnerability handling in the contract, document the controls that apply to your engagement and give you the evidence your supplier risk assessment needs. Whether and how NIS2 applies to your organisation is for you and your counsel to assess.

Will you agree the contract provisions DORA requires?

Yes. We agree the provisions of Article 30 DORA, notify incidents through the agreed channel, document exit plans, take part in resilience testing and supply the information your register of information needs.

Who is responsible for AI Act compliance?

That depends on your role, as provider or deployer, and on the risk class of the use case. We classify each use case with you during discovery, build oversight, logging and documentation into the system, and supply the technical facts your counsel needs for the legal assessment.

Where will our data be hosted and processed?

In locations agreed with you before we build: your own cloud tenancy, an EU region of a public cloud or on premises for sensitive workloads. Hosting and AI services are chosen accordingly, and the choice is documented with its exit options.

How do we request your security documentation?

Through the contact page. Tell us which documents you need and which framework you assess suppliers against, and the right people will get back to you.

Ask for the evidence

Tell us which framework you assess suppliers against and which documents you need. We will tell you what we can share, and how.

Request security documentationAbout FromNine