Andfrankly

Sweden · www.andfrankly.com · 39 vendors

&frankly is a Swedish company that developed a cloud-based employee feedback platform. It provides tools for real-time insights, pulse surveys, and feedback management to help organizations improve employee engagement and workplace culture. The company was acquired by Simployer Group in 2020.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 1 category; runs on 39 sub-vendors.

Insights

Last updated 2026-03-04 · revision 6

39 direct vendors, 349 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Andfrankly exhibits a medium level of migration readiness (Score: 55). **Opportunities:** 1. **Modern Product Architecture:** The company's SaaS-based product offerings imply a modern, likely cloud-native architecture, which is generally well-suited for migration to new platforms or cloud environments. 2. **Vendor Diversity (Assumed):** Assuming the detailed vendor information (111 services from vendors in 10 unique countries) is accurate, this suggests a diverse vendor landscape. Such diversity can reduce overall vendor lock-in and provide flexibility when migrating away from specific services or providers. 3. **Existing Compliance Framework:** Established GDPR compliance means processes for handling sensitive data are mature, which is a good foundation, though these must be rigorously maintained during any migration. **Challenges and Unknowns:** 1. **Internal Tech Stack Visibility:** The specific details of the internal tech stack (e.g., use of containers, microservices) are unknown, making it challenging to accurately plan and estimate the complexity of a migration. 2. **Strict Data Residency:** The requirement for data residency primarily within EU/EEA significantly constrains options for cloud providers and geographic regions during a migration, potentially increasing complexity and cost. 3. **Regulatory Uncertainties:** The "Assessment Required" status for NIS2 and "Unknown" status for SOC2 and ISO 27001 introduce significant regulatory hurdles. A migration project would likely need to incorporate efforts to achieve or confirm compliance with these standards, adding scope and risk. 4. **Financial Stability:** The unknown status of revenue concentration and growth history makes it difficult to assess the financial capacity to fund a potentially large-scale migration project. 5. **Vendor Lock-in:** Despite the apparent vendor diversity, the explicit "Vendor Lock-in Risk: Unknown" indicates an area of uncertainty that needs to be thoroughly assessed before migration. The contradiction between "Total Vendors: 0" and the detailed vendor list also adds ambiguity to this assessment.

Compliance

5 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

As a cloud-based HR technology provider serving enterprise customers, SOC2 compliance would be expected by customers for vendor assurance. While company has ISAE3000 audits (similar international standard), specific SOC2 compliance status is unclear. Medium risk as customers may require SOC2 for vendor management.

Evidence: https://www.simployer.com/support/documentation/simployer-trust-center/gdpr-and-privacy/audits

ISO 27001 (source) — Assessment Required

As an HR technology provider handling sensitive personal data, ISO 27001 certification would be expected for information security management. Company demonstrates strong security practices and undergoes regular audits, but specific ISO 27001 certification status is unclear. Medium risk as certification would strengthen customer confidence and competitive position.

Evidence: https://www.simployer.com/support/documentation/simployer-trust-center/security-and-it/information-security-policy

ISAE 3000 (source) — Compliant

Company explicitly states compliance with ISAE3000 standard through regular audits by PwC. This demonstrates strong assurance practices and commitment to independent verification of controls. Low risk due to established audit program and professional auditor engagement.

Evidence: https://www.simployer.com/support/documentation/simployer-trust-center/gdpr-and-privacy/audits

Financials

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report