Hesehus A/S

Denmark · www.hesehus.com · 19 vendors

Hesehus A/S is a leading Danish e-commerce company specializing in the development of award-winning B2B and B2C webshops. They offer a comprehensive e-commerce platform, Bizzkit, which handles complex product data, digital asset management, and content management. The company also provides consulting services covering digital strategy, design, user experience, and optimization.

Resilience scores

Disruption prediction

Hesehus A/S has an estimated 10% probability of disruption in the next 6 months.

8 of Hesehus A/S's 19 vendors monitored for disruptions.

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 19 sub-vendors.

Insights

Last updated 2026-09-13 · revision 8

19 direct vendors, 317 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Hesehus A/S demonstrates high migration readiness. This is primarily driven by its highly modern and modular tech stack. The adoption of Microsoft Azure, microservices architecture, headless architecture, and MACH principles (Microservices, API-first, Cloud-native, Headless) provides significant flexibility for migrating or evolving their services. Their use of standard frameworks like C#/.NET, React, and Next.js, along with a composable commerce approach (Bizzkit described as a "Connected Composable foundation"), further enhances their ability to adapt and integrate with new environments or platforms. The offering of Shopify solutions alongside their proprietary Bizzkit platform also indicates a strategic openness to diverse platform foundations and reduced platform lock-in. The primary challenges for migration readiness stem from regulatory and compliance aspects. While GDPR compliant, the complexities of data transfers to US-based processors will require careful consideration and planning during any migration, especially if new data processing locations or vendors are involved. The absence of SOC2 and ISO 27001 certifications could also pose a hurdle, as these are often required by clients or for operating in certain regulated environments, potentially adding overhead or delaying migration if new certifications are needed. While Bizzkit is described as composable, its proprietary nature means that migration away from it, if ever desired, might still involve specific efforts compared to a purely open-source or off-the-shelf solution. The missing revenue data prevents a full financial assessment of their capacity to fund large-scale migrations.

Compliance

9 in-scope frameworks identified; showing 3.

EU AI Act (source) — Assessment Required

The EU AI Act entered into force on August 1, 2024, with phased implementation through 2027. Hesehus A/S explicitly offers AI services as part of its service portfolio ('AI' is listed as a core service area) and uses AI for e-commerce optimization, customer journey personalization, and digital strategy. Risk is Medium because: (1) the company is actively developing and deploying AI solutions for clients, potentially making it an AI system provider or deployer under the Act; (2) AI used in e-commerce (recommendation engines, personalization, dynamic pricing) may fall under specific risk categories; (3) the Act's obligations for providers and deployers of AI systems are significant; (4) no AI Act compliance assessment has been publicly disclosed. The specific risk classification of Hesehus's AI systems (minimal, limited, high, or unacceptable risk) requires formal assessment.

Evidence: https://www.hesehus.dk/en/services/ai, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

GDPR (source) — Partially Compliant

Hesehus A/S is headquartered in Denmark (EU), making GDPR universally applicable. The company demonstrates meaningful compliance maturity: they publish a detailed personal data policy (version 5, dated May 14, 2023), cite specific GDPR legal bases (Art. 6(1)(a), (b), (c), (f)) for each processing activity, have appointed a Compliance Officer & Legal Assistant, conduct Transfer Impact Assessments (TIAs) for US data transfers, and use Standard Contractual Clauses (SCCs) with processors. However, the risk is rated Medium rather than Low because: (1) the company openly acknowledges transferring data to US-based processors (Google, Meta, LinkedIn/Microsoft) under FISA-702, CLOUD Act, and E.O. 12333 exposure — a known ongoing compliance risk area post-Schrems II; (2) no formal third-party GDPR audit or certification has been publicly disclosed; (3) as an e-commerce platform provider, Hesehus processes personal data on behalf of its clients (acting as a data processor), which creates additional obligations (DPA agreements, sub-processor management) that cannot be fully verified externally; (4) Danish DPA (Datatilsynet) enforcement has been active in recent years. The absence of a formally designated DPO (they reference a 'Compliance Officer & Legal Assistant' rather than a statutory DPO) may be a gap if they meet the threshold under Art. 37 GDPR.

Evidence: https://www.hesehus.dk/en/personal-data-policy, https://www.hesehus.dk/en/cookies, https://www.hesehus.dk/en/about-us, https://www.datatilsynet.dk/english

ISAE 3000 (source) — Assessment Required

ISAE 3000 is an international assurance standard used for non-financial assurance engagements, commonly applied in Denmark and Scandinavia for IT controls reporting (often as an alternative or complement to SOC 2 in the Nordic market). As a Danish technology company providing cloud-based e-commerce services to large enterprises, Hesehus A/S may face client demands for ISAE 3000 (or ISAE 3402) assurance reports, particularly from Danish financial sector clients or public sector entities. Risk is Low-to-Medium: ISAE 3000 is voluntary and not legally mandated, but its absence may create commercial barriers with certain enterprise clients in the Danish/Nordic market who prefer ISAE-format assurance over SOC 2.

Evidence: https://www.hesehus.dk/en/platform/bizzkit, https://www.fsr.dk/faglige-informationer/revision/standarder/isae-3000

Financials

Three-year financials

Financial Resilience Score: 7/10

Hesehus A/S demonstrates strong financial resilience based on qualitative signals, despite the absence of verified figures from primary CVR filings in this session. The company has won the Børsen Gazelle award six times, most recently in 2024, which requires at least doubling revenue or gross profit over four years with consistent positive growth and profitability. This is an unusually strong external signal of sustained, profitable expansion over more than a decade. The company has been PE-backed since 2021 via Altor/QNTM Group, providing access to capital, professionalised governance, and a Nordic buy-and-build platform. Revenue diversification is improving with two engines: bespoke agency/implementation services and the Bizzkit Commerce Cloud SaaS platform, which brings recurring-revenue quality. Historical profit milestones include DKK 10.8M in 2013 and consistent multi-million DKK profits since 2010. However, resilience is constrained by small absolute scale (~130 employees), concentration in the Danish market, cyclical exposure to retail e-commerce spending, and competitive pressure from much larger global platforms (Shopify, commercetools, Adobe Commerce). The eventual PE exit also introduces ownership uncertainty.

Key strengths: Six-time Børsen Gazelle winner (most recent 2024) confirming sustained profitable growth, PE ownership by Altor/QNTM Group since 2021 providing capital and governance, Dual revenue model: bespoke services plus Bizzkit SaaS platform, Strong enterprise customer references (Matas, BabySam, ASSA ABLOY, Micro Matic), 22-year uninterrupted growth history with consistent profitability, Multiple industry awards (E-handelsprisen gold medals, Great Place to Work)

Risk factors: Small absolute scale (~130 employees) with key-customer and key-employee dependency, Geographic concentration in Denmark with limited international presence, Cyclical exposure to retail digital transformation spending, Intense platform competition from Shopify, commercetools, Adobe Commerce, Optimizely, PE ownership implies eventual exit with potential leverage or ownership change, Possible cannibalisation risk from adding Shopify and Builder.io alongside proprietary Bizzkit

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report