Your data stays in Finland
Sutja is built for Finnish shift work and for Finnish data. Servers, personal data and support are in Finland.
Data and service providers in Finland
Servers, personal data and support are located in Finland. Personal data is not stored outside the EU, and every sub-processor is listed publicly.
A Finnish platform
Finnish, end to end
A Finnish company, with servers and personal data in Finland on Finnish infrastructure. Support and contracts in Finnish.
In Finland and the EU
Personal data is stored and processed in Finland and the EU. Sub-processors are listed publicly on our privacy pages. All of our sub-processors are European companies.
Protection, control and traceability
Encryption
Data is encrypted in transit (TLS 1.2 or newer) and at rest. The most sensitive data, such as absence reasons, bank account, address and notification content, is additionally encrypted field by field with AES-256-GCM before it is stored.
Key management and rotation
Every workspace has its own encryption key, and the master key is not kept in the database. Keys can be rotated without downtime, and destroying a workspace's key makes its encrypted data permanently unreadable.
Encrypted attachments and documents
Medical certificates, receipts and employment contracts are encrypted in file storage. Every download goes through the server, which checks access rights file by file.
Network-level protection
Traffic passes through a European protection layer: DDoS protection, a web application firewall and per-IP request limits before a request reaches our servers. Our domain is DNSSEC-signed, which prevents traffic from being redirected to a spoofed server at the DNS level.
Access control
Role-based access control at workspace and team level, on a least-privilege basis: everyone sees only what they need for their work.
Field-level visibility
Salary, bank account, address and contract details are visible only to the employee, their own supervisor chain and administrators. For other supervisors the fields are masked, and they cannot edit them or open the employment contract.
Backups
Data is backed up regularly, which protects it during disruptions too.
GDPR-compliant
We follow the EU GDPR: data processing agreements, data-subject rights and documentation in order.
Audit log
Every change is logged – who did what and when. Full traceability.
Data breaches
We notify of any breach without undue delay, and within 72 hours at the latest.
Ready to start?
Shifts handled. You focus on people.
Try Sutja free for 14 days. No credit card, no commitment.