Protecting European industry, on cloud infrastructure that is itself beyond reproach
How bifrost moved its European operations to evroc, putting the software that keeps Europe's regulated industries safe beyond the reach of foreign surveillance law.
The challenge
Ask a security company where it runs before you ask what it sells. Buyers now do. A vendor that protects regulated industries is part of their supply chain, and its own infrastructure gets scrutinised fast.
The point is jurisdiction, not geography. Under some legal regimes, a provider can be compelled to hand over data wherever in the world it physically sits, as long as the company holding it falls under that jurisdiction. A data centre in Europe counts for little if the company holding the keys can be ordered to open them from outside it. None of this shows on a calm day. It shows the instant someone with the legal authority to demand the data decides to use it.
For a security firm whose customers, namely regulated operators across the Nordics, carry obligations under Europe's tightening cybersecurity and resilience rules, that kind of exposure is not worth carrying. bifrost settled it early.
What bifrost needed
bifrost is a Swedish company that builds runtime security for Kubernetes, with customers in healthtech and defencetech, where the software is regulated and a breach is never a small matter. Kubernetes is the plumbing most modern software runs on, the system that manages the containers, the small self-contained parts that make up an application. Runtime security, as bifrost does it, means learning exactly what each of those containers is meant to do and allowing nothing else. It does not wait for an attack to show itself and then react; the behaviour an attack would need is simply never permitted.
A company that stops breaches for a living cannot afford one of its own. So, when it came to growing across Europe, bifrost started with its own foundations.
The list was short. A cloud under European control, with no externally controlled software anywhere inside it, so nothing could be compelled from beyond Europe. Enough performance to carry security-critical work deep in the operating system without slowing it down. Live regions in the countries its customers operate in. And a partner to build with for the long haul.
Until recently, a list like that had no European answer. You could have European control, or a cloud that kept up, rarely both, and almost never from a provider building the whole thing itself.
bifrost looked at the market and decided to move its European operations to evroc.
Working with evroc
evroc runs cloud regions in Stockholm, Paris and Frankfurt, all of it European-owned and European-controlled, with no dependency on software that answers to anyone outside Europe. The platform was built from scratch for modern workloads, free of the weight that slows clouds adapted from an older era.
evroc set out to be a genuinely good cloud that also happens to be sovereign, not a sovereign cloud that asks you to accept less. It holds the main international standard for handling information securely, and is built to the same European cybersecurity and resilience requirements its customers answer to.
What makes it closer than a hosting deal is that both companies share the innovative mindset. bifrost started life inside a European Union research project and at Lund University, holds several patents on the method behind its profiling, and is backed by Vinnova, Sweden's innovation agency. evroc engineers its own cloud and AI services in-house, with heavy investment in research. Neither is bolting together someone else's parts. The relationship was set up as a long-term innovation programme, so European industry gets first-rate security on infrastructure no one abroad can touch.
"Customers trust us to keep breaches out of the software they build and run, and that trust has to go all the way down to where we run ourselves. With evroc, we can do that across Europe, on infrastructure no foreign law can reach, and without settling for less performance. Not many others are building this from the ground up in Europe," said Hannes Ullman, CEO of bifrost.
The split is simple. evroc runs the cloud. bifrost then runs the security on top of it.
How the security works
bifrost integrates into the customer developer workflow to help assess every new version that comes through the pipeline, learning how each container behaves. With that knowledge combined with data about known vulnerabilities, bifrost analyses, triages and tailors security measures that help eliminate up to 90% of the exposure. The security teams can then focus their effort on what's actually vulnerable while giving developers back time to build new features, all while they get automatically collected evidence of how they keep their software secure, for auditors and enterprise customers alike.
That is what bifrost now runs across the Nordics, and increasingly the rest of Europe, on evroc. Keeping it there means the work and the data behind it stay under European law, which is also what lets bifrost's customers meet their own obligations, from the second Network and Information Security Directive (NIS2), the Digital Operational Resilience Act (DORA) and the Cyber Resilience Act to audit standards such as System and Organization Controls 2 (SOC 2) and ISO 27001, on a cloud already held to the same rules.
Why it matters
For a security company, the cloud underneath it is one of the first things it has to defend. What counts is what European industry can build on top of it: real protection, at the level the specialists demand, none of it reachable from outside Europe.
bifrost and evroc make a plain point between them. A security vendor no longer has to choose between staying in European hands and running the best there is. Here, it gets both.
