Hosted in Norway
The Rubic service and the member database are hosted in Microsoft Azure’s data centres in Norway.
Security
How we look after your data.
The member register is among the most personal things an organisation has. Here is what applies to hosting, encryption and your data — in concrete terms, with links to the agreements.
What the agreements promise
Encrypted transfer
Traffic to Rubic is encrypted over HTTPS. Login at app.rubic.no uses TLS 1.3.
You own the data
The organisation is the data controller; Rubic is the data processor. We process member data to deliver the service you have agreed to — and for nothing else.
Notification of breaches
In the event of a breach of the agreement or unauthorised access to personal data, you must be notified immediately, with what you need to report it to the Norwegian Data Protection Authority (Datatilsynet).
No new suppliers on the quiet
New subcontractors are notified in writing four months before they are brought into use. You can object within one month and then terminate the agreement with three months’ notice.
Your data out whenever you want
You can request a copy of the data with three working days’ notice. On termination, documents and the database are downloaded, and after 30 days everything is deleted from Rubic’s servers.
Subcontractors
The list is set out in the data processing agreement (version 1.1, effective from 12 October 2026).
Microsoft Azure
Hosting of the Rubic systems, in data centres in Norway.
Kompani Kvam AS
Support and consultancy services.
Abaris Consulting AS
Software development.
Stripe, Inc.
Payment services.
Nets A/S
Payment services.
Swedbank
Payment services.
Sveve AS
SMS.
Mailchimp / Mandrill
E-mail.
Inlet AS
Integration with digital locks.
Iizy AS
Accounting integration.
Catacloud AS
Accounting integration.
Audits, confidentiality and deletion
Rubic carries out regular security audits of the systems that process personal data, and you have access to the reports. You can also require an audit carried out by an independent third party; this may be invoiced separately.
Everyone who works for Rubic — employees and contracted staff — has a duty of confidentiality regarding the personal data, also after the agreement has ended.
When the agreement ends, the data is returned in a standardised format, and Rubic provides a written declaration that everything has been returned or deleted.
The service and the database are located in Norway. E-mail, SMS and payments go through dedicated suppliers: e-mail with Mailchimp/Mandrill, SMS with Sveve, and card payments with Stripe, Nets and Swedbank. Vipps payments are approved in Vipps.
Questions about security
Where is our data stored?
The Rubic service and the member database are hosted in Microsoft Azure's data centres in Norway. Email, SMS and payments go through separate sub-processors, which are listed in the data processing agreement.
Can Rubic employees see our data?
Rubic only processes the data to deliver the service you have agreed to, for example when you ask support for help. Everyone who works for Rubic is bound by a duty of confidentiality, also after the agreement has ended.
What happens to our data if we cancel?
On termination, documents and the database are downloaded, and after 30 days everything is deleted from Rubic's servers. You receive a written statement that the data has been returned or deleted.
What happens in the event of a security breach?
In the event of a breach of the agreement or unauthorised access to personal data, you must be notified immediately, with what you need to report it to the Norwegian Data Protection Authority (Datatilsynet).
Does Rubic use AI on our data?
Only if you switch it on. The AI features in Rubic are turned off by default, and your organisation turns them on itself. They process content you have entered — text an administrator writes or pastes in, and names, descriptions and settings — not information from the member register. Processing takes place on servers in the EU, and the content is not used to train models. This is set out in section 3.7.1 of the data processing agreement.
Who is behind Rubic?
Rubic AS is a Norwegian company based in Lillehammer, founded in 2014, and part of ECIT — a Nordic accounting and IT group with 3,500 colleagues in 11 countries.
The agreements
The terms are set out in the data processing agreement and the service agreement, and in the event of conflict, the agreements prevail. How we process information about you as a website visitor or as a contact person at a customer is described in the privacy policy.