Tibber

Norway · tibber.com · 18 vendors

Tibber is a digital energy company that provides smart solutions and an app to help households manage and reduce their electricity consumption and costs. It offers real-time energy analytics, supplies green electricity, and integrates with smart home devices to optimize energy usage.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 18 sub-vendors.

Insights

Last updated 2026-07-29 · revision 2

18 direct vendors, 275 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Tibber exhibits very high migration readiness, largely driven by its exceptionally modern and cloud-native technology stack. The extensive use of AWS, Kubernetes, and Docker signifies a highly portable and adaptable infrastructure, significantly reducing the technical complexity and effort required for potential migrations to alternative cloud providers or environments. The architecture, characterized by GraphQL, Apache Kafka, and multiple programming languages (Python, Kotlin, TypeScript, Node.js), strongly suggests a microservices-oriented design, which inherently facilitates modular migration of individual components. The presence of a GraphQL-based Developer API also indicates a well-defined interface layer, simplifying integration and re-platforming efforts. Despite these strengths, the assessment notes critical data gaps. Information regarding specific regulatory compliance requirements and data residency rules across its operating countries is missing, which could introduce significant complexity and cost during a migration. Similarly, the absence of financial stability data (revenue, growth) makes it difficult to assess the company's capacity to fund a large-scale migration project. Lastly, while the tech stack promotes portability, the "Vendor Lock-in Risk: Unknown" for the 19 vendor services, coupled with the inconsistent "Total Vendors: 0" data point, means the actual vendor landscape and potential lock-in challenges are not fully clear.

Compliance

12 in-scope frameworks identified; showing 3.

Swedish Energy Regulations — Assessment Required

Tibber AB operates as a licensed electricity supplier in Sweden, subject to the Ellagen (Electricity Act) and oversight by Energimarknadsinspektionen (Ei — Energy Markets Inspectorate). Risk is Medium (rather than High) because Sweden's regulatory environment, while rigorous, has a well-established framework that Tibber has been operating within since its early market entry. NIS2 transposition in Sweden is ongoing, and Tibber's Data Act Policy notes that a responsible Data Act authority has not yet been assigned in Sweden.

Evidence: https://tibber.com/se/villkor, https://tibber.com/en/terms/data-act, https://tibber.com/en/compliance

GDPR (source) — Partially Compliant

Tibber demonstrates strong structural GDPR compliance: it has appointed a Data Protection Officer (DPO), publishes a detailed privacy notice, processes data primarily within the EU/EEA, uses Standard Contractual Clauses (SCCs) and adequacy decisions for third-country transfers, and maintains a lawful basis for each processing activity. However, 'Partially Compliant' is assigned because: (1) some third-party IT service providers may process data outside the EU/EEA, creating residual transfer risk; (2) no independent third-party GDPR audit or certification has been publicly disclosed; (3) Tibber operates across four EU/EEA jurisdictions (Norway, Germany, Netherlands, Sweden), each with local supervisory authorities and nuanced national implementations, increasing the complexity and likelihood of gaps. Enforcement risk is moderate — Norwegian and German DPAs are active regulators. Fines under GDPR can reach €20M or 4% of global annual turnover.

Evidence: https://tibber.com/en/terms/privacy-policy, https://tibber.com/en/compliance, https://tibber.com/en/terms/data-act, https://tibber.com/en/terms/cookies

NIS2 (source) — Assessment Required

NIS2 is highly likely to apply to Tibber as an Essential Entity in the energy sector. Tibber is a digital electricity supplier operating in Germany, Netherlands, Norway (EEA), and Sweden — all EU/EEA member states. The energy sector (electricity supply) is explicitly listed as an Essential Entity sector under NIS2 Annex I. Tibber's scale (operations across four countries, significant customer base, digital infrastructure including smart meters, APIs, and IoT devices) strongly suggests it meets the medium/large enterprise threshold (50+ employees or €10M+ turnover). Risk is rated High because: (1) NIS2 non-compliance can result in fines up to €10M or 2% of global annual turnover for Essential Entities; (2) energy sector is a priority enforcement target for EU regulators; (3) Tibber's digital-first model and IoT infrastructure (Pulse devices, EV chargers, smart home integrations) create significant attack surface; (4) no public NIS2 compliance certification or assessment has been disclosed. Norway, as an EEA member, is expected to implement NIS2 equivalent legislation.

Evidence: https://tibber.com/en/compliance, https://tibber.com/en/terms/privacy-policy, https://tibber.com/en/terms/data-act, https://tibber.com/en/

Financials

Three-year financials

Financial Resilience Score: 6/10

Tibber demonstrates moderate financial resilience underpinned primarily by strong venture capital backing rather than operational profitability. The company has raised over USD 200 million cumulatively from tier-1 investors including Balderton Capital, Eight Roads, Founders Fund, Schibsted, and EQT Ventures, which has funded sustained operating losses and enabled rapid geographic expansion across four European markets. The asset-light, software-centric business model provides scalability advantages over legacy utilities, and the company benefits from strong regulatory tailwinds including EU mandates for smart meters, dynamic tariffs, and demand-side flexibility. However, Tibber has not achieved profitability at the group level and remains dependent on continued equity raises to fund operations. The 2022 European energy crisis exposed working capital vulnerabilities through higher collateral requirements, hedging costs, and customer credit risk. Revenue growth is heavily influenced by pass-through electricity prices rather than pure customer economics, making top-line trends misleading. With approximately 1 million customers across Norway, Sweden, Germany, and the Netherlands by 2024, the company has achieved meaningful scale, but competition from Octopus Energy and incumbents like Fortum, Vattenfall, and E.ON is intensifying.

Key strengths: Strong venture capital backing exceeding USD 200 million from tier-1 investors, Rapid customer growth surpassing 1 million customers across four countries by 2024, Asset-light, software-centric scalable business model, Regulatory tailwinds from EU smart meter and dynamic tariff mandates, Geographic diversification across Norway, Sweden, Germany, and Netherlands

Risk factors: Persistent operating losses with no group-level profitability, Dependence on continued equity raises for funding, Commodity price volatility exposure affecting working capital and hedging costs, Customer credit risk and churn during price spikes, Regulatory risk from market-by-market retail electricity rules (Norwegian strømstøtte, German Strompreisbremse), Intensifying competition from Octopus Energy and incumbent utilities

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report