SalaX Secure Messaging aligns with NIS2 requirements

Control of hosting location

Supports the need to know and control where critical and sensitive data is processed and stored, helping meet national data residency requirements as part of risk management. 

Art. 21(1) (risk management and all hazards view of where systems and data reside)

Organizational control of service

Aligns with governance and supply chain risk reduction by limiting dependency on third country or opaque multi tenant SaaS providers for essential communications.

Art. 21(1) (appropriate organisational measures) and Art. 21(2)(d) (supply chain security).

Customer‑owned encryption keys

Reduces exposure to extraterritorial access and supports cryptographic risk management measures and control over access to sensitive information.

Art. 21(2)(h) (policies and procedures regarding the use of cryptography and encryption).

End‑to‑end encrypted communications

Helps protect the confidentiality and integrity of network and information systems used to deliver essential and important services.

Art. 21(1) (protecting network and information systems) and Art. 21(2)(h) (cryptography/encryption).

Decentralized architecture for federation

Enables cross border and cross entity cooperation without centralizing critical communications on foreign or untrusted infrastructure, supporting coordinated risk management.

Art. 21(1) (risk based technical and organisational measures) and Art. 21(2)(d) (supply chain security, including between entities and service providers).

Data localization for content and files

Facilitates compliance where authorities expect sensitive or security relevant data to stay within defined jurisdictions or trusted infrastructures, and where data location is part of the risk assessment.

Art. 21(1) (documenting and managing risks, including where data resides) as interpreted in data sovereignty guidance.

 Policy‑driven governance 

Supports obligations around documented policies, procedures, and controls for managing risks to essential and important services.

Art. 21(2)(a) (policies on risk analysis and information system security) and Art. 21(1) (organisational measures).

 Auditability and evidence

Provides evidence needed for incident reporting, post incident analysis, and supervisory audits, without exposing logs or content to the provider.

Art. 21(2)(b) (incident handling) and Art. 23 (incident reporting obligations) for having evidence and records.

 Limited vendor access to data 

Reduces the data exposure surface in line with supply chain and outsourcing risks, and supports a defensible “need to know” model.

Art. 21(2)(d) (supply chain security, including security between entities and their service providers).

 Fit for high‑criticality use 

Maps well to essential and important entities whose disruption would significantly affect critical services, making strong control over communications part of their risk management posture.

Art. 21(1) (appropriate and proportionate measures for essential and important entities) and scope provisions in Arts. 2–3.

 Out‑of‑band secure communications 

Gives essential and important entities a hardened, policy controlled channel that remains available and trustworthy if primary systems are compromised (e.g., ransomware on email or M365), supporting secure coordination during major incidents. This directly underpins NIS2’s requirements for incident handling, business continuity, and crisis communication on infrastructure fully under the organization’s control.

Art. 21(2)(b) (incident handling, including detection and response processes) and Art. 21(2)(c) (business continuity, such as backup management and crisis management).