How the three steps work
From mapping your current state to a controlled operating environment and private AI. Each step stands on its own, but together they give you better control over data, risks and business-critical systems.
Step 1 · Migration
EU Cloud Migration – from mapping to a controlled transition
We help you leave or reduce dependence on public cloud services and move relevant systems to a Swedish operating environment. The work starts with a Sovereignty Assessment where we map systems, data flows, dependencies and risks. We then plan the migration with testing, rollback and an agreed cutover – so the impact on your operations is as small as possible.
What's included
- Inventory of systems, data flows, integrations and existing cloud dependencies
- Data classification and mapping of relevant third-country transfers
- Migration plan with a test environment, parallel operation where appropriate and a rollback plan
- Move of virtual machines, containers, databases and storage
- Post-cutover verification together with you
What you get
- Sovereignty Assessment with current state, identified dependencies and recommended actions
- Documented migration and implementation plan
- A verified deployed environment in a Swedish data center
Timeline: The timeline and any planned service impact are set after the assessment based on system dependencies, data volume and the agreed cutover. Regulatory link: gives you a better basis for controlling data flows, supplier dependencies and international transfers in your GDPR and NIS2 work.
Step 2 · Operations
Managed EU Drift – documented operations with Swedish support
Once the environment is in place, we can take care of the ongoing operation of Linux, Windows and containers in a Swedish data center. The service covers monitoring, patch management, backup, restore testing and incident readiness – with clear responsibility boundaries, an SLA and a named contact.
What's included
- Monitoring and alerting around the clock; action levels per the agreed SLA
- Patch management for operating systems and agreed components
- Backup and regularly tested restore against defined RPO/RTO targets
- Access control, logging and documented operating routines
- Incident handling and material that supports your reporting deadlines
- Swedish-speaking support and a named contact per the agreed SLA
What you get
- SLA with agreed response and action targets
- Operational documentation and a runbook for the managed environment
- Recurring operations and security reporting per the agreed scope
Responsibility: For organizations covered by NIS2, we can support the incident process with technical material and documentation per the agreed service. The customer's responsibility to assess and report significant incidents to the competent authority always remains. Regulatory link: the operating routines support NIS2's requirements for risk management and, for financial entities, DORA's management of ICT third-party risk.
Step 3 · Private AI
Smart Source Elevate – AI support in the system you already use
Smart Source Elevate is a private AI layer on top of a specific existing system – for example an intranet, business system or e-commerce platform. The user describes what to do in natural language and Elevate performs only governed, authorized actions in the system. This provides AI support in daily work without giving end users direct access to the system's API.
What's included
- Private AI execution in your controlled environment or in a Swedish data center per the agreed architecture
- Permission control: the AI layer can only perform actions the user is already authorized for
- Governed and auditable connections to an existing system
- Logging and traceability of the AI layer's actions
- Where needed, private knowledge search (RAG) over your own documents
What you get
- A scoped pilot: one system and one high-friction flow with clear control points
- A permission, logging and follow-up model for your specific use
- A measurable basis for decisions on further rollout
Principle: Elevate the systems you already have. Regulatory link: the solution is designed with data under your control, governed access and traceability to support your internal data-protection and information-security requirements. Requirements under GDPR, the AI Act and WCAG are always assessed in the individual implementation.
The regulatory information is general guidance, not legal advice. Read more in the NIS2 Directive, DORA and the European Commission's guidance on international data transfers under the GDPR.