Stø: Sovereign services for banking and finance

Have you ever been impressed by how quickly and easily you can log in to your online bank or public services such as Altinn using BankID? That’s no coincidence. The service is critical to society and a prerequisite for accessing many of the services we rely on in our digital lives. Since 2018, Orange Business has operated these services and several related components on behalf of Stø. 

“We have high expectations when it comes to uptime and availability. Of the major service providers, I’ve been a customer of my experience with Orange Business has been the best. The level of security we gain through this partnership is essential. If BankID goes down, it takes only minutes before it makes the front page of the newspapers,” says Vigdis Volden at Stø. She has more than 20 years of experience in IT operations and vendor management.

• A Banking as a Service module for BankAxept with separate infrastructure for each bank. The operations platform must comply with international security standards to protect card payments and reduce card fraud (ISAE 3402 and PCI DSS).
• Two critical instances that are essential for BankID to function. An international standard service, OpenID Connect, is used here and runs in Orange Business data centers. Nearly one billion transactions are handled each year.
• Operation of an anti-fraud solution (see description below).
• We also operate a cloud service that Stø sells to a third-party providing card services to customers in Denmark, Italy, Spain, and several countries in South America. In addition, Stø has used consultants and other services from Orange Business. Several experts from Orange Business have been involved since the partnership began.

"We are stronger together. We receive very few remarks in the annual audit reports," says a satisfied Volden.

When the partnership began, everything ran on a ‘sovereign cloud’, a Norway-based environment with Data Centers on Norwegian soil and governed by Norwegian law. Today, 50% has moved to Microsoft Azure cloud services, which are also operated in sovereign clouds and local data centres.

“We’re aiming for the right long-term balance between what sits in the cloud and what remains on-prem. Even though our IT strategy says, ‘cloud first,’ we have to take into account the critical services we operate and the frameworks we are subject to. We must follow strict frameworks, and the geopolitical situation is uncertain.

That is why Volden values working with a partner with a strong presence in Norway, with contacts who speak the same language and understand the local market.

‘This is important when you are responsible for services that are unique to Norway, such as BankID and BankAxept. Providers from other markets do not have the same understanding of how these services work and how important they are to society,’ she says.

Volden expects suppliers to understand Stø’s business and to be trustworthy. Volden and her team strive to maintain good and constructive relationships with their suppliers. Being honest on both sides is the recipe for building the best possible collaboration.

“We need to understand our different roles and needs. Together with Orange Business, we have worked extensively on management principles and established meeting forums where we continue to develop routines and procedures for working together in the best possible way. I am very pleased with the professionalism I encounter and feel that we are well supported.”

She believes this form of collaboration is especially important at a time when Stø is undergoing major changes. “We are becoming increasingly productized in what we deliver and therefore need partners who can develop the collaboration in step with us.”