BankID in a sovereign cloud environment

Have you ever been impressed by how quick and easy it is to log in to your online bank or access public services using BankID? That’s no coincidence. BankID is a critical service and essential to ensuring we can access the services we rely on in our digital lives.

Since 2018, Orange Business has been operating these services and associated components on behalf of Stø.

“We have high expectations regarding uptime and availability. Of all the major service providers I’ve used in Norway, my experience with Orange Business has been the best. The security I gain through this partnership is vital. If BankID goes down, it won’t be long before it’s on the front page of the newspapers,” says Vigdis Volden of Stø. She has over 20 years’ experience in IT operations and supplier management.
 

• A Banking as a Service-module for BankAxept with separate infrastructure for each bank. The operating platform requires compliance with international security standards to protect card payments and reduce card fraud (ISAE 3402 and PCI DSS).
• Two key components that are essential for BankID to function. An international standard service, OpenID Connect, is used here, which runs in Orange Business’s data centre. Just under 1 billion transactions are processed here each year.
• Operation of an anti-fraud solution (see description below).

We also operate a cloud service that Stø sells to a third party which provides card services to customers in Denmark, Italy, Spain and several countries in South America. In addition, Stø has utilised consultants and other types of services from Orange Business. Several experts from Orange Business have been involved since the partnership began.

“We are strong together. We don’t receive many comments in the annual audit reports,” says a satisfied Volden.

When the partnership began, everything was managed on-premises in a ‘sovereign cloud’. This means that everything is located in data centres on Norwegian soil and is governed by Norwegian law. Today, 50 percent has been migrated to cloud services from Microsoft Azure, which are also operated in sovereign clouds in local data centres.
- We want to find the right long-term strategy balancing what is in the cloud and what is operated on-premises. Although our IT strategy states ‘cloud first’, we must consider the critical public services we operate and the regulatory frameworks we are subject to. We must adhere to strict regulatory frameworks, and the geopolitical situation is uncertain.

That is why Volden values the fact that she can work with a supplier that has a strong presence in Norway, with contacts who speak the same language and understand the local market.
“This is important when you are responsible for specialised Norwegian services such as BankID and BankAxept. Suppliers from other markets do not have the same understanding of how these services work and how important they are to society,” she says.

Volden insists that suppliers understand Stø’s business and that they are trustworthy.
“Considering the responsibility we carry, I have friends and acquaintances who wonder how I manage to sleep well at night, but I do. I can definitely recommend Orange Business to others.”

Volden and her team strive to maintain good, constructive relationships with suppliers. Daring to be honest on both sides is the key to creating the best possible collaboration.
- We must understand our different roles and needs. Together with Orange Business, we have invested significant effort in developing our management principles and creating forums where we continuously refine the routines and procedures that enable us to work together in the best possible way. I’m very pleased with the professionalism I’ve encountered and feel that we’re being supported effectively.

She believes that this form of collaboration is particularly important at a time when Stø is facing major changes.
- We are becoming increasingly productised in what we deliver and therefore need partners who can develop the collaboration in step with us.