Bleau A/S

Denmark · owned by PubliX Group AB (Sweden) · bleau.dk · 9 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 9 sub-vendors.

Insights

Last updated 2026-09-13 · revision 7

9 direct vendors, 151 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Bleau A/S exhibits high migration readiness due to its modern and flexible technical architecture. The '100% proprietary/self-developed infrastructure' built on a microservices architecture, multi-tenant cloud, REST API, and automated CI/CD provides significant agility for re-platforming or migrating to new environments. Crucially, the 'Total Vendors: 0' data point (interpreted as minimal to no reliance on external IT infrastructure/software vendors) means Bleau is not constrained by third-party vendor lock-in, complex licensing, or contractual dependencies that often hinder migrations. They have full control over their codebase and infrastructure, enabling them to adapt and move their platform with relative ease, provided the target environment meets their specific requirements. The primary challenges to migration readiness stem from the highly regulated environment and strict data residency requirements. As a provider to the Danish public sector, Bleau must adhere to stringent GDPR, NIS2, and Danish data sovereignty rules, which mandate data storage and processing within the EU/EEA (preferably Denmark). This significantly limits the choice of potential migration destinations. Emerging regulations like the EU AI Act and Cyber Resilience Act will add further compliance overhead to any new platform or service. While the proprietary nature reduces external vendor lock-in, a complete re-architecture or move away from their core moliri platform would still involve significant internal development effort. The 100% revenue concentration could also impact the financial flexibility to fund large-scale, complex migrations.

Compliance

9 in-scope frameworks identified; showing 3.

ISAE 3000 (source) — Assessment Required

ISAE 3000 (and its IT-specific variant ISAE 3402) is the European/international equivalent of SOC 2 for assurance reporting on service organizations' controls. As a Danish SaaS provider to public sector clients, ISAE 3402 (Assurance Reports on Controls at a Service Organization) is particularly relevant because Danish public sector auditors and clients frequently require ISAE 3402 reports rather than SOC 2. The risk is medium because: (1) Danish public sector procurement and audit requirements may mandate ISAE 3402 assurance for critical IT service providers; (2) The company's role as a data processor under GDPR Article 28 creates demand for independent assurance of processing controls; (3) No ISAE 3000/3402 report has been publicly identified. The risk is not 'High' because ISAE 3000/3402 is not legally mandated and clients may accept alternative assurance.

Evidence: https://bleau.dk, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits-or, https://www.fsr.dk/faglige-informationer/revision/standarder/isae-3402

Danish Public Procurement Rules — Assessment Required

Bleau A/S serves 300+ public sector clients in Denmark. Public sector contracts in Denmark are governed by the Danish Procurement Act (Udbudsloven, implementing EU Directive 2014/24/EU). As a supplier to public entities, Bleau must comply with procurement rules including: transparent tendering processes, non-discrimination, and compliance with contract terms. Risk is medium because: (1) Failure to comply with procurement rules could result in contract cancellations or exclusion from future tenders; (2) The company's growth to 300+ public clients suggests successful navigation of procurement processes; (3) No procurement violations have been identified.

Evidence: https://bleau.dk, https://bleau.dk/blog/mere-end-250-nye-kunder-slutter-sig-til-bleau, https://www.kfst.dk/udbud/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32014L0024

Danish Web Accessibility Act — Assessment Required

Web accessibility compliance is a core business requirement for Bleau A/S, not merely a regulatory risk. The company explicitly markets its moliri platform as a 'webtilgængelig' (web-accessible) SaaS solution and describes itself as a 'specialist in web-accessible SaaS solutions for the public sector.' The Danish Web Accessibility Act implements EU Directive 2016/2102 and requires all public sector websites and mobile apps to meet WCAG 2.1 AA standards. Since Bleau's clients are public sector entities legally required to comply, Bleau as their CMS provider bears significant responsibility for enabling compliance. Non-compliance by clients due to platform deficiencies would directly damage Bleau's commercial reputation and contractual standing. Risk is High because this is a core value proposition and any failure would be commercially devastating.

Evidence: https://bleau.dk, https://bleau.dk/blog/mere-end-250-nye-kunder-slutter-sig-til-bleau, https://www.digitaliser.dk/resource/6251651, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L2102

Financials

Three-year financials

Financial Resilience Score: 6/10

Bleau A/S demonstrates qualitative financial resilience through its position as a leading GovTech CMS provider in the Danish public sector, with over 300 sticky, multi-year public-sector customers using its moliri platform. Public-sector SaaS contracts typically provide predictable recurring revenue, and the company benefits from structural tailwinds from EU regulation (WCAG, NIS2) that drive demand for compliance-oriented solutions. The November 2024 strategic partnership with Softværket a.m.b.a. adds access to 400+ potential utility-sector customers and represents a meaningful expansion of the addressable market. However, hard financial figures (revenue, EBIT, equity) could not be confirmed as CVR filings were not accessible during the research. As a Danish A/S filing Regnskabsklasse B accounts, disclosure is likely limited to gross profit and net profit, with revenue often undisclosed. The company's small scale relative to competitors like KMD and Netcompany, combined with near-total concentration in the Danish public sector, limits its buffers against adverse events. Overall resilience is moderate: strong niche position and recurring revenue model, but exposed to single-country, single-segment concentration and procurement/framework risks.

Key strengths: 300+ sticky public-sector customers on moliri CMS platform, Category leadership as most widely deployed CMS in Danish public sector, Structural tailwinds from EU compliance regulation (WCAG, NIS2), November 2024 Softværket partnership adds 400+ utility customer opportunity, Diversified public-sector verticals: municipalities, housing, transport, education, utilities, Product expansion into AI (AI Studio) and analytics/compliance (moliri Insights)

Risk factors: Customer concentration in Danish public sector (effectively 100% Denmark), Small-company scale versus larger GovTech competitors (KMD, Netcompany), Procurement risk from dependence on SKI framework agreements, Financial opacity due to abbreviated Class B accounts, Single product line dependence on moliri CMS platform, Exposure to Danish municipal IT budget cycles and political changes

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report