Azure

Azure is used to run applications, store and analyse data, connect systems and build AI solutions. For many companies, this essentially boils down to two things: getting systems that do not communicate with one another to work together through integrations, and having a place to run their applications without needing their own servers. At Exsitec, we work on both aspects: - Integrations automatically move data between systems. A common example is the link between the business system and a system for managing supplier invoices. Suppliers, accounts and purchase orders are retrieved from the business system, and once the invoices have been reviewed and approved, they are automatically transferred back for accounting purposes. This eliminates the need for manual double-entry, and the finance department always works with up-to-date information. - Applications are web apps and tools built to meet the customer’s specific needs, often as a complement to the business system. With today’s AI-supported development, it is quicker than ever to produce bespoke solutions, and the apps can utilise AI themselves, for example to interpret documents or emails. Needs that were previously too specific or too costly for a bespoke solution can therefore now be met with an app tailored to the business. Both types of solution run in the customer’s own Azure environment and are built according to the same approach, which is described in more detail under ‘How does Azure work?’.

Security in Azure is based on a shared responsibility model. Microsoft is responsible for physical security and for the platform itself. The party building the solution is responsible for how it is configured, who has access and how data is managed. The platform Azure is certified to standards including ISO/IEC 27001, 27017 and 27018, and is audited in accordance with SOC 1, SOC 2 and SOC 3. Data is encrypted by default using AES-256 when stored and protected using TLS when transmitted over the network. Permissions are managed via Microsoft Entra ID, which supports multi-factor authentication and role-based access control (Azure RBAC), ensuring that each user and service only has access to what they need. How we approach security - Data in Sweden. By default, we deploy solutions in Sweden Central, ensuring that data is stored in Sweden. - Restricted access. Our access is limited to the subscription we create for the project. We have no permissions in the customer’s Entra ID or in the customer’s other Azure environments. Furthermore, in accordance with Microsoft’s requirements for CSP partners, all our accounts use multi-factor authentication when working in the customer’s environment. - Identities before passwords. We follow Microsoft’s recommendations and, where possible, allow the solution’s components to connect to one another using managed identities rather than passwords. Where keys or passwords are nevertheless required – for example, to connect to an external system – they are stored securely, such as in Key Vault. Deployment from Azure DevOps takes place entirely without stored passwords. - Controlled changes. As the environments are described as code and deployed automatically, every change is traceable and is tested in the test environment before reaching production. - Monitoring. We set up budgets with cost alerts, so that unusual usage – which may indicate errors or unauthorised use – is detected in good time. Application Insights logs events and error