Loading the catalogue…
Intility
L3 · SovereignintilityNorwayEurope
Norwegian managed-IT provider (Intility AS, Oslo) offering a fully managed inference service on OpenAI-compatible APIs, served from Norwegian datacentres. It serves open-weight models for chat and embeddings.
Compliance posture · Stav's assessment
Jurisdiction
EEA · Norway
Data residency
EEA
CLOUD Act / FISA 702
Not exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Strong
Legal exposure
Strong
Serving retention
Strong
Security posture
Adequate
Contractual posture
Strong
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 2 risk items · 5 safeguards · 1 privacy-policy issue · terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 30 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L3SovereignIndicativeregistry 4.3
This level applies to traffic routed through Stav.
Intility is at L3: it is Norwegian-owned and controlled and serves from its own datacentres in Norway. L4 is blocked by the lack of a sovereign qualification such as SecNumCloud.
3 criteria from L4: Sovereign cloud qualification, Effective software control, No revocable third-country dependency.
Stav's own assessment against criterion registry 4.3. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 30 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO/IEC 27001
ISO/IEC 27001:2022, issued by Scandinavian Certification AS (accredited), held by Intility AS and Intility AB, valid until April 2028. Scope: 'Hosting and management of IT platform services'. Intility Inference is built and operated on that certified platform but is not named in the scope. Stav accepts the certificate for the inference service on that basis, together with Intility's audited ISAE 3402 Type II report for the platform. · substantial assurance · Current · verified 20 Oct 2026
ISAE 3402 Type II
Information security controls, Cloud Controls Matrix based. Independent auditor's report. Available from Intility on request. · substantial assurance · Current · verified 20 Oct 2026
ISAE 3000 Type II
Privacy controls in Intility's role as data processor under GDPR Article 28. Independent auditor's report. Available from Intility on request. · substantial assurance · Current · verified 20 Oct 2026
CSA STAR (Trusted Cloud Provider)
Intility AS is listed in the CSA STAR registry. STAR level and scope are not confirmed. · Current · verified 22 Sept 2026
NSM grunnprinsipper for IKT-sikkerhet
Platform developed and operated in accordance with NSM ICT security principles · Claimed by the provider
SOC 2 Type II
Not held · verified 22 Sept 2026
ISO/IEC 42001
Not held · verified 22 Sept 2026
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)not published
Sub-processor listnot published
Links to every document and certificate — 2 legal documents, 7 certification sources
Compiled by Stav from the provider's published documentation. Last verified 30 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 2
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| GLM-5.3 | €1.94 | €7.29 | 0.70 s | 411 |
| Qwen3 Embedding 8B | €0.10 | — | 0.17 s | 0 |