Compliance & Certifications
We comply with the highest security standards and European regulations to ensure the protection of your data in a certified environment.
ISO 27001:2022
CERTIFIEDInformation Security Management System
ISO 27001:2022 certification demonstrates our commitment to information security. This international standard establishes the requirements for implementing, maintaining and continuously improving an Information Security Management System (ISMS).
Security Policies
Access control and risk management
Data Encryption
Protection in transit and at rest
24/7 Monitoring
Real-time threat detection
Regular Audits
Continuous verification of controls
ENS Alto
HIGH LEVEL Coming Soon (Final Certification Feb 2026)Spanish National Security Framework
The National Security Framework (ENS) at Alto (High) level is the highest certification level established by the Spanish Government. It guarantees that our systems meet the most demanding security requirements for the protection of Public Administration information.
Public Sector
Suitable for government and sensitive data
Legal Compliance
Royal Decree 311/2022
600+ Measures
Implemented security controls
Data Sovereignty
Data hosted in Spain
Additional Compliance
Our services also comply with the following regulations
GDPR
EU General Data Protection Regulation
ISO 14001
Environmental Management and sustainability
TIER III+
Uptime Institute data center compliance
PCI DSS
Payment card data security
Mandatory Supplier Requirement
At EDH, security does not end at our facilities. All our suppliers must mandatorily comply with ISO 27001 and ENS Alto as an essential condition to work with us.
This ensures that every link in the service chain maintains the same security standards that we demand internally, from the data center and connectivity to software and auxiliary services.
ISO 27001
Mandatory for all suppliers who manage or access client data.
ENS Alto
Mandatory for infrastructure, connectivity and critical service providers.
Continuous Auditing
Periodic verification of each supplier's certification compliance.
Contractual Agreements
Security and compliance clauses integrated into all third-party contracts.
Implemented Security Measures
Our commitment to security goes beyond certifications. We implement technical and organizational controls across all layers.
Physical Security
Biometric access control, 24/7 CCTV, security personnel
End-to-End Encryption
AES-256 at rest, TLS 1.3 in transit
Backup & DR
Geo-redundant copies and business continuity plans
Access Management
RBAC, mandatory MFA, least privilege principle
Vulnerability Management
Periodic pentesting and bug bounty program
Logging & Auditing
Immutable logs and regulatory-compliant retention
Shared Responsibility Model
Security is a joint effort. This model clearly defines what EDH covers and what responsibilities belong to the client.
EDH Responsibility
- check_circle Physical data center security (biometric access, CCTV, 24/7 surveillance)
- check_circle Network, power and cooling infrastructure with N+1 redundancy
- check_circle DDoS protection and network perimeter security
- check_circle Hypervisor, firmware and base platform patching
- check_circle Infrastructure regulatory compliance (ISO 27001, ENS Alto, GDPR)
- check_circle Monitoring, alerts and infrastructure incident response
Client Responsibility
- check_circle Operating system, applications and deployed middleware
- check_circle User management, credentials and access policies for their systems
- check_circle Application-level data encryption and key management
- check_circle Firewall configuration and security rules at VM/server level
- check_circle Backup and recovery policy for their data and applications
- check_circle Sector-specific and industry regulatory compliance
With our Cloud Managed Services, EDH can take over the complete management of client responsibilities.
DPA — Data Processing Agreement
AVAILABLEGDPR-compliant Data Processing Agreement
EDH offers a standard Data Processing Agreement (DPA) to all its clients, complying with Articles 28 and 29 of the GDPR. This document formalizes how we process personal data on behalf of our clients.
NIS2 — European Directive
COMING SOONNetwork and Information Systems Security Directive
The NIS2 Directive (EU 2022/2555) strengthens cybersecurity obligations for critical infrastructure providers in the EU. As a provider of essential digital services, EDH is actively preparing for compliance, pending transposition of the regulation into Spanish law.
info Pending transposition into Spanish law. EDH already meets most requirements through ISO 27001 and ENS Alto.
Security Incident Management
Structured response process aligned with GDPR and NIS2 to ensure swift and transparent action in the event of any incident.
Detection
24/7 monitoring with automated alerts. Initial incident classification by severity (critical, high, medium, low).
Containment
Immediate isolation of the affected system to prevent propagation. Activation of the incident response team.
Remediation
Root cause elimination, system restoration and integrity verification before returning to production.
Post-Mortem
Forensic analysis, detailed client report, lessons learned and preventive control updates.
schedule Notification SLAs
Critical Incident
Data breach, total service outage or security compromise
High Incident
Significant degradation or actively exploited vulnerability
Medium Incident
Contained incident with no direct impact on client data
Aligned with the GDPR 72-hour notification requirement and the NIS2 24-hour directive.
Need compliance documentation?
Request our certificates.