---
title: Technical and Organisational Measures (TOMs) | MWM
description: "The security measures MWM applies to personal data in the Print365 Suite: Azure hosting regions, access control, encryption, logging, backups and incidents."
---

[Skip to content](https://www.mwm.se/legal/toms#main-content)

[![MWM](https://www.mwm.se/hubfs/raw_assets/public/mwm-theme/images/mwm-logo.svg) Print365](https://www.mwm.se/?hsLang=en)

- [Home](https://www.mwm.se)
- [Print365](https://www.mwm.se/print-365) 
    - [Print365 Go](https://www.mwm.se/print-365-go)
    - [Print365 Pro](https://www.mwm.se/print-365-pro)
    - [Print365 Integrated](https://www.mwm.se/print-365-integrated)
    - [Print365 DatAInsights](https://www.mwm.se/print365-datainsights)
- [FAQ](https://www.mwm.se/print-365-faq)
- [About MWM](https://www.mwm.se/about) 
    - [Management team](https://www.mwm.se/team)
    - [Careers](https://www.mwm.se/careers)
- [Partner program](https://www.mwm.se/partners)

[Book a demo](https://www.mwm.se/book-a-demo?hsLang=en)

Legal

# MWM Technical and Organisational Measures (TOMs)

The security measures MWM applies to the personal data it processes for MWM Print365 Suite customers.

---

Filed under: Legal Version 2.0 · Effective November 10, 2026

## 1. Purpose and scope

This page describes the technical and organisational measures that MWM Group AB and MWM System Inc. (each "MWM") apply to ensure a level of security appropriate to the risk, in line with Article 32 of the GDPR. The measures apply to all processing of personal data that MWM carries out on behalf of customers under the [MWM Data Processing Addendum](https://www.mwm.se/legal/dpa?hsLang=en).

## 2. Risk-based approach

MWM applies a risk-based approach to information security. The measures take into account:

- the nature, scope and purpose of the processing;
- the categories and limited volume of personal data processed;
- the likelihood and impact of risks to data subjects;
- customer-specific configurations and security controls;
- recognised industry best practices.

The personal data processed consists of limited B2B contact information (company e-mail addresses and company telephone numbers) and the user account and login data of the customer's users. No special categories of personal data as defined in Article 9 GDPR are processed.

## 3. Technical measures

### 3.1 Processing environment

- Personal data is stored and processed in Microsoft Azure environments operated by MWM.
- Customers contracting with MWM Group AB are hosted in the European Union (Azure regions North Europe, Ireland, and West Europe, the Netherlands).
- Customers contracting with MWM System Inc. are hosted in the United States (Azure regions East US and West US).
- Separate production and test/development environments are maintained.
- Data is encrypted at rest and in transit using Microsoft Azure's standard security and encryption mechanisms.

### 3.2 Access control

This section describes access to user accounts in the customer's Print365 environment. Access by MWM's own personnel is described in sections 4.1 and 4.2.

- Access to systems containing personal data is restricted to authorised users.
- Access rights for users in the customer's environment are approved and managed by the customer's designated administrator, including any external users, such as consultants, that the customer chooses to authorise.
- Role-based access control is applied. Customers configure roles, including authentication requirements, IP restrictions and multi-factor authentication (2FA/MFA) where required.
- The customer's designated administrator withdraws access rights in the customer's environment, including when an employment or assignment ends.
- MWM reviews the access rights held by its own personnel and withdraws them when they are no longer required, in accordance with section 4.2.

### 3.3 Authentication and identity management

- Authentication follows the customer-defined role configurations.
- Strong authentication controls, including MFA and IP-based restrictions, can be enforced in the customer's setup.

### 3.4 Data protection

Personal data is protected against unauthorised access, disclosure, alteration and destruction. Each customer's data is logically isolated from other customers through tenant-based separation within the platform.

### 3.5 Logging and monitoring

- User logins and administrative access are logged within the Azure environment.
- Logs are used for traceability, troubleshooting and security monitoring.
- The customer has access to its logs as the primary party, and MWM accesses them when required, for example for incident investigation or support.

### 3.6 Backup and availability

- Backup is handled through Microsoft Azure's built-in backup and resilience mechanisms.
- Backup and restore procedures are tested regularly as part of MWM's ongoing security work.
- MWM assists the customer with restore activities when required.

### 3.7 Change management

- Changes to systems processing personal data are managed in a controlled manner.
- Where applicable, changes and updates are tested in non-production environments before deployment to production.
- Change activities follow established operational practices to protect data security, availability and integrity.

## 4. Organisational measures

### 4.1 Confidentiality

- All personnel with access to personal data are bound by confidentiality obligations, included in both employment and consultancy agreements.
- Within MWM, access to personal data processed on behalf of customers is granted to employed personnel only. This does not limit which users the customer authorises in its own environment under section 3.2.

### 4.2 Personnel management

- Access to personal data is limited to what is necessary for assigned tasks.
- Access rights are reviewed and removed when no longer required.

## 5. Incident management

Procedures are in place to identify, assess and manage personal data incidents. Customers are informed without undue delay, and normally within 24 hours of MWM becoming aware of a personal data breach. This gives the controller time to meet its own obligation to notify the competent supervisory authority within 72 hours under Article 33 GDPR.

## 6. Sub-processors

- Sub-processors are engaged only with prior authorisation from the controller, as set out in the [Data Processing Addendum](https://www.mwm.se/legal/dpa?hsLang=en).
- Microsoft Azure is the cloud infrastructure provider, in the regions listed in section 3.1.
- Atlassian (Jira Service Management) provides the support portal, with data stored in the European Union.
- Sub-processors are bound by appropriate data protection and security obligations, and MWM remains responsible for the protection of personal data they process.

## 7. Physical security

Physical security is provided through Microsoft Azure's data centre controls, including access control, monitoring and environmental protection.

## 8. Standards and best practices

MWM follows recognised information security practices aligned with ISO/IEC 27001 and NIST.

## 9. Review and maintenance

These measures are reviewed periodically and updated as needed to ensure continued compliance with Article 32 GDPR. Updates maintain or improve the overall level of protection.

## 10. Contact

Data protection and information security: MWM Group AB, Medborgarplatsen 25, 118 72 Stockholm, Sweden. E-mail [info@mwm.se](mailto:info@mwm.se), telephone +46 8 5000 87 70.

## 11. Version history

| Version | Date | Summary of changes |
| --- | --- | --- |
| 1.7 | January 21, 2026 | Baseline version issued to customers. |
| 1.8 | July 20, 2026 | Data protection contact updated. |
| 1.9 | September 8, 2026 | Access control clarified to distinguish customer user accounts from MWM personnel. Incident notification trigger and its relationship to Article 33 GDPR clarified. |
| 2.0 | November 10, 2026 | Published at mwm.se/legal/toms. Scope extended to MWM System Inc. and US hosting. User account and login data added to the personal data processed. Atlassian added as sub-processor. Contact changed to info@mwm.se. |

[![MWM](https://www.mwm.se/hubfs/raw_assets/public/mwm-theme/images/mwm-logo.svg) Print365](https://www.mwm.se/?hsLang=en)

- [Home](https://www.mwm.se)
- [Print365](https://www.mwm.se/print-365)
- [FAQ](https://www.mwm.se/print-365-faq)
- [About MWM](https://www.mwm.se/about)
- [Partner program](https://www.mwm.se/partners)

[Book a demo](https://www.mwm.se/book-a-demo?hsLang=en)

© 2026 MWM Group AB · C/O The Works, Medborgarplatsen 25, 118 72 Stockholm [Legal](https://www.mwm.se/legal?hsLang=en) · [Privacy Policy](https://www.mwm.se/legal/privacy-policy?hsLang=en) [+46 8 500 087 70](tel:+46850008770) · [info@mwm.se](mailto:info@mwm.se) · [LinkedIn](https://www.linkedin.com/company/mwmgroupab/)

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://www.mwm.se/#organization",
  "@type" : "Organization",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "SE",
    "addressLocality" : "Stockholm",
    "postalCode" : "118 72",
    "streetAddress" : "C/O The Works, Medborgarplatsen 25"
  },
  "alternateName" : [ "MWM Group AB", "MWM Group for Print & Publishing" ],
  "contactPoint" : {
    "@type" : "ContactPoint",
    "availableLanguage" : [ "en", "de", "sv" ],
    "contactType" : "sales",
    "email" : "info@mwm.se",
    "telephone" : "+46 8 500 087 70"
  },
  "description" : "MWM Group AB develops Print365, the Print MIS / ERP for newspaper and commercial printing production. Founded in Stockholm in 1998, part of Valsoft Corporation since 2022.",
  "email" : "info@mwm.se",
  "foundingDate" : "1998",
  "identifier" : {
    "@type" : "PropertyValue",
    "propertyID" : "SE Organisationsnummer",
    "value" : "556638-6354"
  },
  "industry" : "Print management information systems",
  "legalName" : "MWM Group AB",
  "logo" : {
    "@type" : "ImageObject",
    "url" : "https://8594844.fs1.hubspotusercontent-na1.net/hubfs/8594844/raw_assets/public/mwm-theme/images/mwm-logo.png"
  },
  "name" : "MWM Group",
  "parentOrganization" : {
    "@type" : "Organization",
    "name" : "Valsoft Corporation",
    "url" : "https://www.valsoftcorp.com"
  },
  "sameAs" : [ "https://www.linkedin.com/company/mwmgroupab/", "https://www.crunchbase.com/organization/mwm-media-workflow-management" ],
  "telephone" : "+46 8 500 087 70",
  "url" : "https://www.mwm.se"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://www.mwm.se/#website",
  "@type" : "WebSite",
  "inLanguage" : "en",
  "name" : "Print365 by MWM Group",
  "publisher" : {
    "@id" : "https://www.mwm.se/#organization"
  },
  "url" : "https://www.mwm.se"
}
```