We are SOC 2 Type 2 audited and ISO 27001 certified

Norditech AB, the company behind Incredible, now holds both a SOC 2 Type 2 report and an ISO/IEC 27001:2022 certificate. Both were issued by Sensiba, an independent auditor.

The ISO 27001 certificate arrived in March. The SOC 2 Type 2 report followed this week. It covers the Security, Availability and Confidentiality criteria for the period from 3 November 2025 to 3 February 2026.

Companies give Incredible access to the tools where their real work happens. Before an IT team allows that, they ask how we handle their data, and they want more than our word for it. Now they have an answer from the outside.

Two halves of the work

Compliance is partly about software and partly about how a company runs. We split it that way.

Nikola Plantic Tomasic led the company side: the team, the office and the business. That is where our written policies come from, covering access control, asset management, incident response, business continuity, how people join and leave the team, and how we handle data.

Emil Wagman, our CTO, led the technical side: how the product and our own systems are built, and who can reach what. Every account and the production database has its own login, access to encryption keys is restricted, data is encrypted, and the product goes through penetration testing.

What the auditors looked at

SOC 2 Type 2 is not a snapshot. The auditor checks that the controls worked over a period of time, three months in our case, so everything had to be written down, followed, and provable afterwards.

ISO 27001 asks a different question: does the company have a working system for managing information security, with the risks named and someone responsible for each.

Our controls fall into five groups: infrastructure security, organizational security, product security, internal security procedures, and data and privacy. They are monitored continuously.

What it means for customers

• Data on our servers is encrypted at rest and in transit.
• We do not train on your data, and our agreements with our AI providers forbid them from training on it.
• We keep zero data retention with those providers wherever possible.
• Your data is deleted when you leave.

Security teams can go through the controls, the policies and our subprocessors in our Trust Center, and request the reports there.