Actility

France · www.actility.com · 28 vendors

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 1 category; runs on 28 sub-vendors.

Insights

Last updated 2026-08-14 · revision 2

28 direct vendors, 259 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Actility exhibits high migration readiness primarily due to its highly modern and cloud-centric internal tech stack. The extensive use of AWS IoT Core, AWS CloudFormation, AWS IoT Greengrass, and Microsoft Azure IoT, combined with containerization (Docker) and orchestration (Kubernetes), signifies a cloud-native architecture that is inherently flexible and well-suited for migration. The reliance on REST APIs, MQTT, and Kafka further supports interoperability and modularity, facilitating easier transitions. Many of its products are designed for cloud integration or are distributed via cloud marketplaces (e.g., AWS Marketplace), indicating existing experience and infrastructure for cloud operations. However, several critical pieces of information are missing, which prevent a perfect score. The regulatory environment and specific data residency requirements are not specified, which can introduce significant complexities and costs during migration. Financial stability, which impacts the ability to fund a large-scale migration, is also unknown. While vendor geographic diversity is noted, the specific vendor lock-in risk is explicitly 'Unknown', and the contradictory 'Total Vendors: 0' data point makes it difficult to assess the true vendor landscape and potential dependencies. Despite these unknowns, the strong technical foundation positions Actility very favorably for future migrations.

Compliance

8 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Actility SA is a French company (EU-based) processing personal data of EU/EEA residents including employees, customers, and end-users of its ThingPark® platform. GDPR is universally applicable. The published privacy policy (last updated September 2019) is significantly outdated and lacks several mandatory GDPR elements: no explicit Data Protection Officer (DPO) contact, no lawful basis articulation per Article 6, no data subject rights section (Articles 15–22), no data retention periods, no mention of international data transfers or Standard Contractual Clauses (SCCs), and no supervisory authority complaint rights. As a cloud IoT platform provider, Actility also acts as a data processor for its operator/enterprise customers, requiring Data Processing Agreements (DPAs). The risk is HIGH because: (1) French DPA (CNIL) is one of the most active enforcement authorities in the EU; (2) fines can reach €20M or 4% of global annual turnover; (3) the outdated privacy policy represents a clear compliance gap; (4) as a B2B IoT platform provider, Actility processes device telemetry data that may include location data (via Abeeway GPS trackers) which can constitute personal data under GDPR.

Evidence: https://www.actility.com/actility-privacy-policy/, https://www.actility.com/about-actility/, https://www.cnil.fr/en/gdpr-what-it-means-and-what-it-changes

ISO 27001 (source) — Assessment Required

ISO 27001 (Information Security Management System) is highly relevant for Actility as a cloud IoT platform provider managing network infrastructure for thousands of enterprises and telecom operators globally. Risk is MEDIUM because: (1) Actility's ThingPark® platform is described as 'industrial-grade' with 'high availability and security' suggesting security awareness, but no certification evidence is publicly available; (2) enterprise and telecom operator customers in regulated sectors (energy, utilities, smart cities) typically require ISO 27001 certification from critical vendors; (3) NIS2 compliance (which likely applies) strongly aligns with ISO 27001 controls; (4) absence of public certification creates vendor risk concerns for customers. The risk would be elevated if Actility's customers contractually require ISO 27001 and it is not certified.

Evidence: https://www.actility.com/lorawan-security/, https://www.actility.com/about-actility/

SOC 2 (source) — Assessment Required

Actility operates ThingPark® as a cloud-based SaaS/PaaS IoT platform serving enterprise and telecom operator customers globally, including in the US market. SOC2 (Service Organization Control 2) is highly relevant for cloud service providers handling customer data, and enterprise/operator customers increasingly require SOC2 Type II reports as part of vendor due diligence. Risk is MEDIUM because: (1) without a SOC2 report, Actility may face competitive disadvantage and customer trust issues; (2) enterprise customers in regulated industries (energy, utilities) may contractually require SOC2 attestation; (3) no public SOC2 report or attestation has been found, creating uncertainty about the security controls environment; (4) the 2019 privacy policy suggests security governance may not be fully mature.

Evidence: https://www.actility.com/lorawan-security/, https://www.actility.com/about-actility/

Financials

Three-year financials

Financial Resilience Score: 5/10

Actility is a category-leading LoRaWAN platform company with deep technology moats, blue-chip strategic shareholders (KPN, Orange, Swisscom, Foxconn), and a globally deployed ThingPark platform serving tier-1 telcos across 100+ countries. It raised over USD 100 million cumulatively, including a landmark USD 75M Series D in 2017, and has diversified via acquisitions of Abeeway, Acklio, and API-K. These attributes provide meaningful resilience through recurring platform revenue, standards influence (co-inventor of LoRaWAN), and strategic customer-investors. However, the company is widely believed to have remained loss-making, consistent with the scale-up IoT software profile. The January 2026 acquisition by Netmore Group (backed by Polar Structure) rather than an IPO suggests standalone cash-flow break-even had not been achieved and shareholders opted for a strategic exit. Combined with limited public financial disclosure (French SME confidentiality option applied), competitive pressure from cellular IoT (NB-IoT, LTE-M, 5G RedCap) and open-source LoRaWAN stacks (ChirpStack, The Things Stack), plus the cautionary precedent of Sigfox's 2022 receivership, the standalone resilience is moderate. Post-acquisition, financial backing from Netmore/Polar Structure should improve resilience going forward.

Key strengths: Category leadership as co-inventor of LoRaWAN and founding member of LoRa Alliance, ThingPark platform powers majority of public LoRaWAN networks worldwide, Blue-chip strategic shareholders and customers (Orange, KPN, Swisscom, Foxconn), Combined Netmore+Actility footprint of >14 million contracted IoT devices in >100 countries, Diversified product suite across connectivity, geolocation (Abeeway), safety (API-K), and SCHC (Acklio), Over USD 100M in cumulative funding raised, New parent Netmore/Polar Structure brings infrastructure-investor patience

Risk factors: Historically loss-making profile typical of IoT scale-ups, Acquisition rather than IPO suggests standalone break-even not achieved, Concentration risk in LoRaWAN adoption by telco partners, Competitive pressure from cellular IoT (NB-IoT, LTE-M, 5G RedCap), Competition from open-source LoRaWAN stacks (ChirpStack, The Things Stack), Sigfox 2022 receivership illustrates LPWAN market risk, Limited financial transparency due to French SME confidentiality declaration, Post-acquisition integration risk with Netmore

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report