Keepit A/S Due Diligence

Run due diligence on Keepit A/S: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by TRISTATE INVEST I ApS (Denmark) · keepit.com · 34 vendors

Keepit A/S is a Danish cloud data protection company that owns and operates a vendor-independent cloud platform purpose-built for backing up and recovering SaaS application data, including Microsoft 365, Salesforce, Google Workspace, and more. The company provides immutable, air-gapped backup and recovery services with no third-party sub-processors, supporting compliance with frameworks such as GDPR, NIS2, DORA, and HIPAA. Headquartered in Copenhagen, Denmark, Keepit serves customers globally through offices in the US, UK, Germany, Poland, France, Brazil, and the Netherlands.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 34 sub-vendors.

Insights

Last updated 2026-09-13 · revision 35

34 direct vendors, 270 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

8 in-scope frameworks identified; showing 3.

NIS2 (source) — No public evidence

Keepit is a cloud computing service provider operating within the EU. Under the NIS2 Directive, such entities are classified as 'Important Entities' and must comply with the directive's cybersecurity risk management and reporting obligations.

Evidence: https://www.keepit.com/blog/why-keepit-for-resellers/, https://www.keepit.com/security/compliance/nis2/, https://www.keepit.com/blog/nis2-key-to-compliance/

GDPR (source) — Evidence found

Keepit A/S is established in Denmark, an EU member state, and processes customer, employee, and supplier personal data, making the General Data Protection Regulation directly applicable.

Evidence: https://www.keepit.com/resources/gdpr-compliance-and-readiness/, https://www.keepit.com/privacy-policy/, https://www.keepit.com/Assets/Pdf/DPA_October_2020.pdf, https://www.keepit.com/security/compliance/, https://www.keepit.com/security/compliance/nis2/

ISAE 3000 (source) — Evidence found

ISAE 3402 (a type of ISAE 3000 engagement) is relevant for service organizations as it provides assurance on controls related to financial reporting. Keepit's customers may require this for their own audits.

Evidence: https://scsd.ch/events-safe-url/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6MjkzMTg4LCJwdXIiOiJibG9iX2lkIn19--1b394b02657459e49956dfed65e250d9a294484c/Keepit-cybersecurity-factsheet.pdf, https://lp.keepit.com/hubfs/Sales%20enablement/Keepit-Security_Whitepaper_May2022.pdf, https://www.keepit.com/Assets/Pdf/DPA_October_2020.pdf

Financials

Three-year financials

Financial Resilience Score: 7/10

Keepit A/S demonstrates strong financial resilience for a private growth-stage SaaS company, underpinned by a well-diversified capital base of approximately USD 90M in cumulative equity funding and a USD 60M senior credit facility (upsized and refinanced in September 2025). Management has explicitly stated that cash reserves are projected to remain robust for years ahead, with only a portion of the previous credit facility drawn. The investor base spans specialist growth equity (One Peak), a state-backed Danish promotional bank (EIFO), and a global venture/innovation lender (HSBC Innovation Banking), reducing single-source funding risk. The business model benefits from recurring SaaS revenue with reportedly high customer retention, rapid customer base growth (from ~10,000 customers in late 2024 to over 18,000 by September 2025), and strong regulatory tailwinds from NIS2, DORA, GDPR, and HIPAA. The company holds defensible positioning as a vendor-independent, immutable cloud backup provider, recognized as a Leader by IDC MarketScape and QKS Spark Matrix. However, the score is constrained by the absence of public profitability disclosure—press releases emphasize growth and retention but not EBITDA or profitability, suggesting the company is likely still loss-making, typical of VC/growth-equity-backed SaaS scale-ups. Capital intensity is elevated due to owning data centers across 7 regions, and channel-only distribution (since January 2024) creates dependency on distributor relationships. Competition from well-funded players (Veeam, Rubrik, Druva, Cohesity-Veritas, AvePoint) is intensifying.

Key strengths: Cumulative equity funding of ~USD 90M from One Peak, EIFO, and others, USD 60M credit facility from HSBC Innovation Banking and EIFO (Sept 2025), Management states multi-year cash runway with only partial credit facility drawn, Diversified investor base (growth equity, state-backed bank, innovation lender), Recurring SaaS revenue model with high customer retention, Rapid customer growth: 10,000+ (late 2024) to 18,000+ (Sept 2025), Strong regulatory tailwinds (NIS2, DORA, GDPR, HIPAA), Leader recognition by IDC MarketScape, QKS Spark Matrix, Canalys, ISO/IEC 27001 certified, SOC 2 Type 1, TISAX audit completed

Risk factors: No public profitability disclosure; likely still loss-making, High capital intensity from owning data centers in 7 regions, Channel-only distribution dependency since January 2024, Heavy concentration in Microsoft 365 / Entra ID workloads, Well-funded and consolidating competition (Veeam, Rubrik, Druva, Cohesity-Veritas, AvePoint), FX exposure across USD/EUR/GBP invoicing with DKK reporting, Microsoft policy or pricing changes on backup APIs is a strategic risk

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report