Security and Compliance · onVisit by Visma
Security and compliance in onVisit
onVisit is developed and operated by Adaptive AS, part of the Visma Group, according to an ISO/IEC 27001-based management system, in Microsoft Azure within the EU, with 24/7 security monitoring from Visma Security Center. Here you will find what IT, security and data protection officers need to evaluate the solution.
- ISO/IEC 27001-based ISMS
- Visma Cloud Delivery Model
- Microsoft Azure · EU
- GDPR · data processing agreement
- NIS2-ready traceability
- 24/7 SOC
ISO 27001
based management system (ISMS)
EU
data storage in European Azure regions
24/7
monitoring, detection and response
99,99%
historical availability last year*
*Stated historical availability – not a guarantee. Agreed uptime and compensation are regulated in the agreement.
Briefly explained
What does security and compliance mean in a visitor system?
A visitor system processes personal data about guests and employees, and for many businesses is part of the physical access control. Security and compliance are therefore about three things: that the service is developed and operated according to a documented security framework, that personal data is processed in line with GDPR with data minimization, deletion deadlines and a data processing agreement, and that the business can document who was in the building when – as NIS2, the Security Act and the Internal Control Regulations increasingly require.
Supplier
Adaptive AS – part of Visma since 2024
Norwegian developer of visitor systems since 2009, AAA credit rating. As part of Visma, onVisit follows the group's security program and supplier transparency.
The
Visma Cloud Delivery Model
Security requirements throughout the development cycle: code review, vulnerability management, change control and documented preparedness – from design to production.
Surveillance
Visma Security Center
The group's security function with 24/7 SOC, incident and crisis management, threat intelligence and continuous improvement of controls.
Security framework
How onVisit is developed and operated
control
ISMS based on ISO/IEC 27001
Established information security management system with clear roles, risk management, internal controls and regular audits.
Development
Secure Development (VCDM)
Security requirements in the development process, code reviews, vulnerability management, change control and testing before production deployment.
Drift
Microsoft Azure
Segmentation, encryption in transit and at rest, key management, monitoring and logging. High availability and continuous security updates.
Visma Security Program
onVisit is part of Visma's joint security program. Findings from monitoring, testing and audits are followed up with the product team.
Continuity
Emergency preparedness and recovery
Monitoring, notification and established incident management routines provide rapid response. Documented contingency plans cover recovery and communication. Historical availability last year: 99,99%.
Personvern og databeskyttelse
GDPR as standard – not as an add-on
You are the data controller, Adaptive is the data processor. Data processing agreement and overview of subcontractors are included.
Data minimization
Only what the visit requires
onVisit stores name, company, mobile number and email where registered, possibly license plate number, visit period and visit recipient. You control which fields are required.
Deletion deadlines
Automatic deletion
Guests who do not want to be remembered are anonymized after a number of days you set (default 10, can be set to 0). Guests who have consented to storage are automatically deleted after 365 days without a visit. Manual anonymization when required.
Storage
European Azure regions
All data in onVisit Online is stored in Microsoft's operations center in Western Europe. No storage outside the EU. Data storage, data flow and backup are described in detail upon request.
Obligation to provide information
Privacy text in the registration
The guest receives information about the treatment directly at check-in, in the chosen language. The text is adapted to the establishment's own regulations.
Transparency and control
Reports and exports
Dynamic reports with export make internal controls, access requests and audits easier.
Third parties
Transparency about subcontractors
An overview of subcontractors is provided with the data processing agreement. If you use Google Forms for your HSE declaration, Google is the data processor for the form data.
Access and identity
Who gets to do what – and who is the guest?
Employees
SSO with Microsoft Entra ID
Log in to the onVisit portal with your organization's own identity provider and MFA policy.
User management
Catalog sync via SCIM 2.0
Employees and visitor recipients are created, updated and deactivated automatically from Entra ID. Terminated employees are deleted within 24 hours of deactivation.
Rights
Roles and permissions
Predefined roles (administrator, company administrator, reception, visitor receptionist, user) and custom roles limited to specific locations.
Guest's identity
Digital identification with BankID
The guest scans the ID card in the BankID app upon check-in. Can be combined with HSE or NDA declaration and manual ID check as a fallback.
Access
Approval before access
The authorization module requires the host or receptionist to approve the visit before the guest is allowed in – for drop-in, pre-registered, or both.
Physical access
QR against locks and doors
With integration with access control, the guest's QR code grants access only to approved zones, according to the company's rules.
Regulations
NIS2, Security Act and internal control
The requirements for traceable physical access control are being tightened. A digital visitor system is part of the documentation.
NIS2
Traceable access control
Businesses in critical and important sectors must document physical and logical access control, maintain access logs and assess supplier risk. onVisit provides a log of who was in the building when, and Visma provides supplier transparency.
Security Act
Documented access control
Security-approved businesses must be able to document visitor control. ID verification, authorization and logging support this.
Internal control and HSE
Evacuation and documented routines
The Working Environment Act § 3-1 and the Internal Control Regulations require an overview of who is in the building. Real-time evacuation list and SMS notification are built-in.
A full review of the legal requirements can be found in the guide to legal requirements, GDPR and NIS2 . The features support compliance, but meeting the requirements must be assessed against the business's own risk and routines.
Documentation
This can be obtained upon request.
For procurement, risk assessment and auditing.
Document package
- Data Processing Agreement (DPA)
- Overview of subcontractors
- Security architecture description
- Data storage, data flow and backup
- Description of ISMS and Visma Cloud Delivery Model
- Response to security form (e.g. in tenders)
How do you proceed?
Send an inquiry with what documents you need and the purpose (procurement, DPIA, audit). We will normally respond within a few business days, and will be happy to arrange a meeting with IT or the data protection officer.
Frequently Asked Questions
Frequently asked questions about security and privacy
Where is the data stored in onVisit?
All data in onVisit Online is stored in Microsoft's Western Europe operations center (Azure). No data is stored outside the EU, and data is only accessible to authorized personnel.
Is onVisit ISO 27001 certified?
onVisit is developed and operated under an information security management system (ISMS) based on ISO/IEC 27001, as part of Visma's security program and Visma Cloud Delivery Model. Documentation of the management system is available upon request.
Do we get a data processing agreement?
Yes. A data processing agreement and an overview of subcontractors are included with the agreement. You are the data controller, Adaptive AS is the data processor.
How long is visitor information stored?
It's up to you. The default is that guests who do not want to be remembered are anonymized after 10 days (can be set to 0), and that guests who have consented to storage are deleted after 365 days without a visit.
How does onVisit help with NIS2?
onVisit provides documented and traceable physical access control: who was registered in and out, when, and by whom the visit was approved. As part of Visma, the supplier transparency required by NIS2 is also provided.
Are SSO and automatic user synchronization supported?
Yes. Login with SSO from Microsoft Entra ID and synchronization of employees via SCIM 2.0. Terminated employees are automatically deactivated.
Who monitors the service?
Visma Security Center, the Visma Group's security function, provides 24/7 security operations (SOC), incident and crisis management, and threat intelligence for onVisit.
Does IT or data protection officer need more information?
We will send the document package and will be happy to review the security architecture, data flow and data processing agreement.
also read
More about safe visitor management
Legal requirements
Visitor registration: legal requirements, GDPR and NIS2
Data Privacy (GDPR)