Septima

Denmark · owned by Independent (Denmark) · www.septima.dk · 7 vendors

Septima offers consulting, system development, services, and products that ensure the optimal utilization of geodata. The company's vision is to help businesses, public authorities, and private organizations maximize the benefits of free and open geographical data. They specialize in developing geospatial systems, services, and products, with a strong commitment to open-source and open data principles.

Resilience scores

Technology vendors

Services catalogue

4 services in catalogue across 1 category; runs on 7 sub-vendors.

Insights

Last updated 2026-09-13 · revision 1

7 direct vendors, 114 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Septima demonstrates high migration readiness. A key strength is its extensive reliance on open-source geospatial technologies (QGIS, PostGIS, PostgreSQL, OpenLayers, GeoServer, MapServer, GDAL/OGR/PROJ, OpenStreetMap). This significantly reduces proprietary vendor lock-in, offering substantial flexibility for data and application migration. The internal tech stack also includes modern cloud platforms (AWS, Microsoft Azure) and .NET Core, indicating a cloud-aware and adaptable environment that is well-suited for re-platforming or re-hosting. While 'Total Vendors: 0' is confusing, the underlying technology providers are geographically diverse (US, Denmark, Germany), which can simplify migration complexity by not being tied to a single regional ecosystem. The primary challenges and unknowns for migration readiness stem from the lack of data regarding specific regulatory environments, data residency requirements, and financial stability (ability to fund a migration). Addressing these unknowns would further enhance their migration strategy.

Compliance

6 in-scope frameworks identified; showing 3.

Danish Data Protection Act — Partially Compliant

The Danish Data Protection Act supplements GDPR with national specifications and derogations. It is enforced by Datatilsynet (the Danish Data Protection Authority). Septima's privacy policy references Datatilsynet and GDPR rights, indicating awareness. However, the policy was last updated in April 2019 and may not reflect subsequent guidance from Datatilsynet. The risk mirrors the GDPR assessment — Medium due to limited scope of personal data processing but outdated documentation.

Evidence: https://septima.dk/politikker/, https://www.datatilsynet.dk/, https://www.retsinformation.dk/eli/lta/2018/502

GDPR (source) — Partially Compliant

Septima is a Danish company headquartered in Copenhagen and therefore squarely within GDPR jurisdiction. They process personal data including IP addresses, names, email addresses, job applicant CVs, and publicly sourced property register data (Tingbogen, EJF, CVR). A privacy and cookie policy is published and references Datatilsynet and data subject rights, indicating baseline awareness. However, the policy was last updated in April 2019 — before several significant GDPR enforcement developments — and there is no publicly disclosed Data Protection Officer (DPO) appointment, no record of a Data Processing Agreement (DPA) framework being published, and no evidence of a formal GDPR audit or certification. The risk is Medium rather than High because Septima does not appear to process special category data (Article 9) or large volumes of sensitive personal data; their data processing is relatively limited in scope. However, the outdated policy and absence of a DPO or formal compliance documentation elevate the risk above Low.

Evidence: https://septima.dk/politikker/, https://www.datatilsynet.dk/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

NIS2 (source) — Assessment Required

NIS2 applies to 'Important Entities' in the digital providers sector (online marketplaces, online search engines, cloud computing services) and 'Essential Entities' in critical infrastructure sectors. Septima is a geographic IT consultancy and software developer serving Danish public authorities and private companies. They use AWS and Azure cloud but are a consumer/integrator of cloud services, not a cloud provider themselves. Their primary activities — GIS consulting, geodata system development, training, and open-source contributions — do not clearly fall within the NIS2 Annex I (Essential) or Annex II (Important) sector classifications. Critically, Septima appears to have approximately 40 employees based on the staff directory, which is below the NIS2 size threshold of 50+ employees (medium enterprise). If headcount is confirmed below 50 and annual turnover is below €10M, NIS2 would not apply. Risk is Low because the sector and size indicators both suggest non-applicability, but formal confirmation of employee count and turnover is needed.

Evidence: https://www.cfcs.dk/da/cybersikkerhed/nis2/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555, https://www.ski.dk/aftaler/se-aftale/?id=02170021, https://septima.dk/ydelser/

Financials

Three-year financials

Financial Resilience Score: 6/10

Septima P/S appears to be a stable, niche-leading small Danish GIS consultancy with a defensible market position built on deep specialisation in geospatial IT and Danish open public data (grunddata). The company benefits from being a listed supplier on three SKI framework agreements (02.06, 02.17, 02.22), which provides recurring access to Danish state and municipal customers without repeated procurement processes—a significant source of demand resilience. Its diversified offering across custom consulting, proprietary products (OneDoor, Databox, Widget, Map, Mergin Maps, Tilsyn med Risikotræer), and QGIS training courses reduces single-line dependency. However, the company is small in scale (estimated 20-40 employees), operates from a single Copenhagen office, and has heavy customer concentration in the Danish public sector, making it sensitive to Danish public-sector IT budgets and procurement cycles. Geographic concentration is essentially 100% Denmark with minimal international exposure. The P/S legal structure implies committed partners with skin in the game, and open-source credibility (NetTopologySuite committers, QGIS community leadership) reduces key-person risk perception among customers. Absent access to the actual årsrapporter, a mid-range resilience score is appropriate—reflecting qualitative strengths in niche positioning offset by small scale and concentration risks.

Key strengths: Niche specialisation in Danish geospatial IT and open public data with high barriers to entry, Listed supplier on SKI framework agreements 02.06, 02.17, 02.22 providing recurring public sector demand, Diversified revenue mix across consulting, proprietary products, and training, Open-source credibility via NetTopologySuite and QGIS community leadership, P/S structure implies committed partners with skin in the game, Steady maturation with progressive product rollout since founding circa 2013

Risk factors: Small scale (estimated 20-40 employees) limits buffer against loss of key clients or employees, Heavy customer concentration in Danish public sector, Geographic concentration essentially 100% Denmark, Dependence on continued Danish open-data (grunddata) policy, Competition from larger GIS consultancies (NIRAS, Geoinfo/Esri Denmark, Atkins, Sweco), Single office location in Copenhagen

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report