FDVhuset AS | Trust Center
Famac Trust Center
Security, reliability, and a partner you can trust
View security and controls

Compliance

ISO 27001

NS-EN ISO/IEC 27001:2023 Certified quality management system

ISO

9001:2015 - Internationally recognized standard for Quality Management Systems (QMS)

GDPR

Compliance with data protection regulations through technical and organizational measures

NIS 2

Famac operates in line with the principles of NIS2

Resources

Access documentation related to security, privacy, and compliance in Famac. This includes certifications, data processing agreements, and our subprocessor overview.Dokumentene inkluderer sertifiseringer, databehandleravtaler og oversikt over underleverandører.

Iso 27001 Certificate

Certificate for the information security management system

ISO 9001 Sertificate

Certificate for the quality management system and continuous improvement

Environmental Certification (Miljøfyrtårn)

Documentation of our environmental and sustainability certification

Privacy Policy

Information on how we process personal data and ensure privacy

Security Summary

Overview of security practices, certifications, and architecture in Famac

Data Processing Agreement

Data processing agreement

AI Data Processing Addendum

Addendum covering the use of AI in connection with data processing

Subprocessor list

Overview of subprocessors used in the delivery and operation of Famac

Overall architecture for Famac

Overview of technical and organizational security measures in Famac

Service Level Agreement (SLA)

SLA for Famac

View all

Subprocessors

Famac uses selected subprocessors for the operation, development, and delivery of the service.

IT Sjefen AS

Hosting, operations, and maintenance of servers, as well as IT consulting related to Famac. Processes: System and operational data

Data location: Norge

Senior Dev AS

External development of Famac (web and app), including testing and ongoing technical improvements. Processes: System and development-related data

Data location: Norge

Twilio Inc.

Authentication and notification services used for login and communication. Processes: Phone numbers, authentication data, and timestampsBehandler: Telefonnummer, autentiseringsdata og tidspunkt

NewActual Reports OÜ / PDF Generator API

Generation of PDF documents via API for contracts and reports. Processes: Document data (temporary)Behandler: Dokumentdata (midlertidig)

Data location: EU (Estland)

TellusR

Development and maintenance of AI-related components hosted on FDVhuset’s own infrastructure. Processes: System data (no external storage)

Data location: Norge

Zendesk Inc.

Customer support platform for handling inquiries and support requests. Processes: Name, email, phone number, and support communication

Data location: EU (AWS Frankfurt)

Monitoring

Continuously monitored by Secureframe

Continuous monitoring of security controls ensures a consistently high standard of information security, availability, and risk management.

FAQs

Find answers to some of the most frequently asked questions. If you can’t find what you’re looking for, please contact our support team.

Famac is certified in accordance with ISO 27001 and ISO 9001, as well as Miljøfyrtårn. We also operate in line with the principles of NIS2.
All data registered by customers in Famac is stored in Norway. Some internal support systems may process data in the EU or other regions, in accordance with applicable security and privacy requirements.
Access to Famac is managed through role-based access control and the principle of least privilege. Secure authentication methods are used, including multi-factor authentication where applicable.
Famac has established procedures for identifying, managing, and following up on security incidents in accordance with internal processes and applicable regulations.
We have established processes for detection, notification, and incident handling. We use 24/7 monitoring through Cynet, and all incidents are managed through strict internal procedures, including logging, analysis, and remediation.
Yes, data in Famac is backed up regularly. Restoration processes are tested to ensure data can be recovered when needed.
Yes, we use selected subprocessors for the operation and development of Famac. All vendors are assessed and monitored in line with our requirements for security, privacy, and data processing.
Famac follows a structured process for identifying, assessing, and resolving vulnerabilities as part of its secure development lifecycle. Security is integrated throughout design, development, and testing, with continuous monitoring for known vulnerabilities. All updates, including security patches, are handled through a controlled change management process. Changes are tested in separate environments, reviewed, and approved before being deployed to production to ensure stability and minimize risk.
No, customer data is not used to train general AI models.
We comply with GDPR and have implemented technical and organizational measures to protect personal data.
About FDVhuset

Secure and modern FM platform

FDVhuset develops and operates Famac, a modern platform for facilities management, operation, and maintenance of buildings. We combine technical quality, strong data security, and continuous improvement to meet the highest security standards in the real estate industry.

ISO 27001 ISO 9001 Norwegian cloud solution

Contact

Do you have questions about security, GDPR, or data processing agreements?

GDPR and Privacy

For questions related to privacy, legal basis, or data processing agreements, please contact our security team.

Send email

Famac Support

For support, bug reports, or questions about functionality in Famac, please contact our support team through the in-app support center.

Available to all customers

Monitoring

Access Security

Complex Passwords
Personnel are required to use strong, complex passwords and a second form of authentication to access sensitive systems, networks, and information
Unique Access IDs
Personnel are assigned unique IDs to access sensitive systems, networks, and information
Least Privilege in Use
Users are provisioned access to systems based on principle of least privilege.
Administrative Access is Restricted
Administrative access to production infrastructure is restricted based on the principle of least privilege.
Encryption-in-Transit
Service data transmitted over the internet is encrypted-in-transit.
Access Control and Termination Policy
An Access Control and Termination Policy governs authentication and access to applicable systems, data, and networks.
Asset Inventory
A list of system assets, components, and respective owners are maintained and reviewed at least annually

Vulnerability Management

Vulnerability and Patch Management Policy
A Vulnerability Management and Patch Management Policy outlines the processes to efficiently respond to identified vulnerabilities.
Vulnerability Scanning
Vulnerability scanning is performed on production infrastructure systems, and identified deficiencies are remediated on a timely basis.
Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.

Incident Response

Incident Response Plan
An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.
Lessons Learned
After any identified security incident has been resolved, management provides a "Lessons Learned" document to the team in order to continually improve security and operations.

Availability

Testing the Business Continuity and Disaster Recovery Plan
The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Business Continuity and Disaster Recovery Plan based on the test results.
Business Continuity and Disaster Recovery Policy
Business Continuity and Disaster Recovery Policy governs required processes for restoring the service or supporting infrastructure after suffering a disaster or disruption.
Backup Restoration Testing
Backed-up data is restored to a non-production environment at least annually to validate the integrity of backups.
Uptime and Availability Monitoring
System tools monitors for uptime and availability based on predetermined criteria.
Automated Backup Process
Full backups are performed and retained in accordance with the Business Continuity and Disaster Recovery Policy.

Network Security

Automated Alerting for Security Events
Alerting software is used to notify impacted teams of potential security events.
Network Traffic Monitoring
Security tools are implemented to provide monitoring of network traffic to the production environment.
Logging and Monitoring for Threats
Logging and monitoring software is used to collect data from infrastructure to detect potential security threats, unusual system activity, and monitor system performance, as applicable.

Risk Assessment

Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.
Vendor Risk Management Policy
A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.

Change Management

Baseline Configurations
Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed.
Segregation of Environments
Development, staging, and production environments are segregated.
Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.
Software Change Testing
Software changes are tested prior to being deployed into production.

Organizational Management

Disciplinary Action
Personnel who violate information security policies are subject to disciplinary action and such disciplinary action is clearly documented in one or more policies.