Where an IT services firm's data promises are tested

Most IT services firms promise clients that their data is kept apart from everyone else's. I treat that promise as something to be demonstrated rather than asserted. At Lumivara I set the separation standard for each service: which services give a client its own tenancy, which share infrastructure with logical controls, how encryption keys are held and who can approve an exception. I review the access groups that cross client boundaries every quarter, because they are created for good reasons during migrations and incidents and almost never removed. In 2021 one of them gave 64 engineers read access to 138 client analytics environments. Since then every cross-client access path has a named owner, an expiry date and a ticket that justifies it. Separation has a cost, and I prefer to price it openly as a service tier rather than promise it to everyone and fund it from margin nobody can see.

Clients in the public sector and banking increasingly buy cloud services on the strength of where data is stored. I work on the less visible questions: who can administer the systems, which legal entity employs them, which country they work from and which subprocessors touch the data or its metadata. European data protection authorities have treated remote access from outside the European Economic Area as a transfer of personal data, so an EU data centre run overnight from elsewhere does not give a client what it thinks it bought. At Lumivara I led the move of night operations for our sovereign tier to our own teams in Tallinn and Vilnius, and I introduced a monthly access statement that shows each client every role that reached its environment. I also report the exceptions, including the two components whose vendors may still need support from outside the EU in rare faults.

Lumivara builds AI features for clients, deploys AI tools internally and resells others' models inside managed services. My office keeps a register of the 61 AI systems in those three positions, each with a named business owner, its data sources, its intended use and the evidence that it does what we claim. The EU AI Act entered into force in August 2024 and its obligations apply in stages, with different duties for those who provide an AI system and those who deploy one. I prefer to describe that structure carefully rather than quote deadlines that have been the subject of further proposals. In practice I insist on three things before an AI system reaches a client: a written statement of what it should not be used for, a test of its accuracy on that client's data where possible, and a way to withdraw the client's data from any model trained on it.

Running other organisations' IT produces data of genuine value: incident rates, patch delays, cloud costs per workload and service-desk volumes across hundreds of comparable systems. I own Lumivara's small line of data products, which earned €23 million in 2025, and I have set three rules for it. Products built from client operational data are available only to clients who contribute, never to the software vendors who sell to them. Every published figure rests on at least eight contributors, and no contributor may account for more than a quarter of a figure. And a contributor can leave, with its data removed from the next release. These rules come from statistical disclosure control, which I learnt as a register statistician, applied to commercially confidential data rather than personal data. They have cost us revenue, and I think they are the reason clients keep contributing.

For most of the personal data we hold, Lumivara is a processor acting on clients' documented instructions under contracts required by the GDPR. I make sure our practice matches those contracts in the places where it most often drifts: backups, logs, ticket attachments, subprocessors and the end of a contract. Since 2020 every departing client receives a signed certificate listing each system from which its data has been deleted, supported by the destruction of the encryption keys that protect its backups. I also work with our cloud business on the EU Data Act's switching obligations, which began to apply in 2025 and require providers to make it easier for customers to move to another provider. My test is simple. A client leaving us should receive a complete, usable copy of its data and evidence that ours is gone, without needing a lawyer to ask for either.