Chief Data Officer / Europe
Decisions that made Lumivara's data promises true, and their price
- Clients whose data Lumivara holds
- 2,300
- Public sector, banks, utilities and manufacturers, 2026
- Capital to give 138 clients separate tenancies
- €9.4m
- Managed analytics service, 2021–2022
- Deletion certificates issued
- 312
- Every departing client since June 2020
Decisions & consequences
01Separating 138 client analytics environments after finding one access group that reached them all
In September 2021 a review by my office found that a support access group used by 64 platform engineers could read every one of the 138 client environments in our managed analytics service. The group had been created during a 2018 migration so engineers could troubleshoot quickly, and nobody had narrowed it afterwards. Thirteen months of logs showed no query outside a support ticket; older logs did not exist. The service ran on two shared clusters with logical separation, and our contracts told clients, among them 31 municipalities and nine banks, that their data was kept apart.
We removed the group within 48 hours. With our data protection officer, I recommended that we notify all 138 clients as their processor within five days, saying what we knew and what we could not know. Four clients notified their supervisory authority; none found evidence of misuse.
The harder decision was what to do next. Our head of cloud services argued that fixing the permissions and adding monitoring, at about €1.2 million, met industry practice. Our chief financial officer warned that full separation would take the service margin from 24% to about 17%. I argued that a promise of separation resting on one access group being configured correctly was a promise made on behalf of our least careful engineer. The board, given both papers, approved a separate tenancy for every client at €9.4 million of capital and €3.1 million a year in additional running costs.
Over fourteen months we migrated each client to its own tenancy. Seventy-two chose to hold their own encryption keys. Engineers now reach a client environment only through approval for a named ticket, and the client can see each session. We raised prices by 8–15% over three years. Six clients, with €2.3 million of annual revenue, left in protest. The margin fell to 18% in 2023 and recovered to 21% in 2025, and in 2023 we retained a public-sector framework that required separate environments.
Separation is now a priced tier across our services rather than a promise made everywhere. Looking back, I got the order wrong. I commissioned the access review in my seventh month; it should have been my first. And I would have published the price schedule with the first notice, because clients who learnt the cost later felt it had been hidden.
Training a service-desk model only on the tickets clients agreed to share
In 2023 our service desks handled 6.8 million tickets a year for about 1,400 clients, and our product team proposed a language model trained on five years of those tickets to route requests and draft replies. The projected saving was €14 million a year. The tickets were written by our clients' employees, and they contained names, telephone numbers and, now and then, details of sick leave or salary errors. A competitor was already marketing an AI service desk.
My concern was not whether the model would work but on what terms we held the data. Our contracts allowed us to process ticket data to provide each client's service. Training one model on every client's tickets would be processing for our own purposes, which would make us a controller for that processing with our own legal basis to find, and the model might reproduce one client's details in a reply to another. Our head of managed services argued that clients would welcome a better service and that asking permission would slow us by a year. Our product lead thought an opt-in would produce too little training data.
I proposed two tracks. A routing model trained only on structured metadata, such as category, system and time, would serve every client. Text-based training would happen only for clients who signed a separate addendum, after redaction, with the right to withdraw their data and have the model retrained. The executive team accepted it, and we gave up about half the projected saving for 2024.
Forty-seven clients, contributing 1.9 million tickets a year, opted in by the end of 2024. The metadata model routes 71% of tickets correctly, against 58% under the old rules; the opt-in model routes 86%. In testing we ran 4,000 prompts designed to extract one client's data in another's session and found no leak. Two clients later withdrew, and we retrained the model within three weeks. The saving reached €6.1 million in 2025.
We now treat any reuse of client data for our own products as a separate agreement. What I would change is the addendum. Our first draft was written by lawyers for lawyers, and about 300 clients sent questions before deciding. I should have drafted it with three clients' data protection officers and built the withdrawal path before launch, not while the first request waited.
Selling an operations benchmark only to the clients who supply it
By 2023 Lumivara held seven years of operational data from running clients' systems: incident rates, time to apply security patches, cloud cost per workload and service-desk volumes for hundreds of comparable organisations. Our commercial team proposed a Nordic IT operations index, sold to software vendors, analysts and investors as well as to clients, and estimated vendor and investor sales at €6 million a year. Most of the data was not personal, but it was commercially sensitive. A bank's incident rate or a municipality's patch delays are not facts their owners would choose to publish.
I argued that the product should be sold only to clients who contribute to it. Our chief commercial officer and head of strategy disagreed in writing. They pointed out that the data was aggregated and that our contracts allowed us to use anonymised operational statistics to improve our services. I accepted that the use might be defensible on the contract. My objection was that a client's vendors would be buying insight into that client's weaknesses, and that the contracts' authors had not imagined this use.
The product launched in March 2024 on three rules. Every published figure rests on at least eight contributors, and no single contributor may account for more than a quarter of it. Only contributors may buy it, and small contributors receive it free. Any contributor may leave, and its data is removed from the next quarterly release. We gave up the vendor and investor market entirely.
By December 2025, 212 clients were contributing and paying, revenue reached €8.4 million and 93% of subscribers renewed. Two clients told us that the benchmark had influenced their renewal of managed services contracts worth €31 million in total. The cost appeared elsewhere. At launch our cell rules suppressed 41% of the figures for Norway and Denmark, where we have fewer clients, and several contributors there complained that they were paying for empty tables.
The rules have since become standard for all our data products, and the board receives an annual note on which contributors could be identified from any figure we publish. What I would do differently is the design for smaller countries. We should have built Nordic regional comparisons from the start rather than country cells. I also priced by contributor size, which gave our largest clients the most value for the least money.
Proving deletion when a client leaves
When Lumivara acquired Brantmark Cloud in May 2019, the two companies deleted departing clients' data in different ways. Brantmark removed production data within thirty days but kept backup tapes for thirteen months. Lumivara removed production data within ninety days and kept backups on a rolling schedule. Neither could show, for a particular client, that every copy had gone. That autumn a Swedish public agency leaving us asked for a signed certificate covering its backups as well as its live systems. I could not honestly sign one.
I proposed a single exit standard for the combined business. Backups would be encrypted with a separate key for each client, so that destroying the key at exit made every backup copy unreadable without restoring and erasing each tape. Retention of backups for departing clients would fall to 35 days. Each exit would end with a certificate listing every system from which the client's data had been deleted, and our auditors would test a sample each year.
Our head of operations objected that we would lose the ability to restore a former client's data in a dispute. Our general counsel worried about litigation holds. We answered the first by telling clients plainly that after 35 days nothing could be restored, and the second with a written hold procedure approved by legal before any key is destroyed. The key management work cost €2.7 million, and the integration programme waited four months for it.
The first certificate was issued in June 2020. By the end of 2025 we had issued 312, each within 45 days of exit. In 2021 our auditors' sample found two places the certificate had not covered: an archive of application logs and a store of ticket attachments. We added both and wrote to the clients concerned. The same year a former client asked us to restore data three months after leaving. We could not, as we had told them at exit, and they were unhappy.
The certificate is now standard across the group and helped us prepare for the EU Data Act's switching obligations. What I would do differently is the mapping. I wrote the certificate from the systems I knew held client data, rather than tracing every route data took through logs, attachments and monitoring tools. An auditor should not have been the one to find those two stores.