School data is sensitive.
We treat it that way.
Vklass carries data about children, students, guardians and staff, from attendance to student health documentation. Security is part of how the platform is built.
Swedish hosting with redundancy and the highest protection level
Vklass is hosted in Sweden. Data is stored and processed within the EU/EEA, on servers in Sweden, and hosting is redundant so that the school day keeps working even when individual components fail. The server hall is built to the highest protection level under the specifications of MSB, the Swedish Civil Contingencies Agency, and backups stay in Sweden too. Current service status is published openly on the support site.
If an incident occurs, we investigate and remediate it. We inform affected school authorities in line with the data processing agreement and the GDPR's incident reporting requirements. That way the school authority can meet its obligations towards the supervisory authority and the data subjects.
Systematic work with information security
Vklass works systematically with information security. The work is governed by our information security policy and led by the information security officer, with support from the data protection officer.
We work on a risk basis: we identify, analyze and manage risks continuously and follow up measures in a risk register. The security work includes secure development, secure operations, access and permissions, supplier management, staff IT security, incident handling and continuity.
Security maturity is measured continuously throughout the year. That is the level required when school data must be protected under NIS2 and other applicable law.
GDPR, NIS2 and other security requirements
Vklass works on a risk basis and systematically with information security. The security work includes risk management, incident handling, continuity, secure development, access control and supplier security. The work is developed continuously based on applicable legislation, customer requirements and established security practice, including requirements that follow from NIS2 and the Swedish Cybersecurity Act.
Privacy by design, with a clear division of roles
Personal data handling is based on a clear division of roles. The school authority (the municipality or the owner of an independent school) is the data controller. Vklass is the data processor and processes data on the school authority's behalf and according to its instructions.
- Processing is governed by a data processing agreement (DPA) between the school authority and Vklass. The sector-standard agreement templates from SKR, the Swedish Association of Local Authorities and Regions, are commonly used.
- Vklass processes data on instruction and solely to deliver the service. Data is never sold on.
- Roles and permissions decide who sees what: a teacher sees their students and a guardian sees their children.
- Data subjects' requests for data extracts, rectification or erasure go to the school or the school authority, which retrieves the material from Vklass.
- As data controller, the school authority is responsible for deciding how long different personal data may be processed. Vklass provides functions and processes for retention and erasure and processes the data in accordance with the school authority's documented instructions and the data processing agreement. Closing an account therefore does not automatically mean that all data is erased.
Supplier security
Suppliers that can affect the security of the service or process personal data undergo risk-based security and data-protection assessments. Critical suppliers are followed up on a recurring basis during the contract period.
Vklass is covered by the Visma Security Program
Vklass is part of Visma and is covered by the Visma Security Program. The program sets the same security baseline for every company and product in the group.
The security culture is built by employees making deliberate decisions every day, supported by dedicated security engineers and the Visma Security Guild. Maturity is measured continuously. Vulnerabilities are found by our own systems, by independent teams and by security researchers around the world, so they can be fixed before anyone exploits them. A security operations capability works around the clock to detect and contain incidents. Anyone who wants to raise a concern can use a confidential whistleblowing channel.
Protected identities and sensitive data in the product
Protection for the most exposed data is built into the platform:
- Vklass supports students with protected personal data, so schools can manage them without the information showing in everyday workflows.
- Data about support measures and student health is protected in several layers, by school-level roles and by per-case access. The right people can work effectively, and no more people than necessary get insight.
- For sensitive views, schools can require step-up authentication with, for example, BankID, Freja eID or the organization's identity provider at an elevated assurance level.
- Read history in sensitive areas provides traceability for reviews.
Research collaboration with privacy first
Vklass takes part in a research study on school absence run by the Stockholm School of Economics and funded by the Swedish Research Council. It is a triple helix collaboration between academia, school authorities and Vklass. Data is anonymized before it is shared: names and personal identity numbers are removed, and no free-text notes or sensitive comments are included. When socioeconomic factors are included, it happens in a collaboration between the Stockholm School of Economics and Statistics Sweden (SCB) using a dedicated key, so individuals can never be identified. The study has been reviewed and approved by the Swedish Ethical Review Authority (ref. 2025-03539-01).
Privacy, cookies, accessibility and service status
The collected texts (privacy policy, cookie policy, accessibility statement, service status and contact routes) live on a dedicated page.
Privacy policy
How Vklass processes personal data as processor and as controller.
Cookie policy
Which cookies and similar technologies the company site uses, and which it does not.
Accessibility and status
Accessibility statement, current service status and contacts for security and data protection.
Security questions in your procurement?
We are happy to walk through hosting, data processing agreements and architecture with your data protection organization.