What Expisoft does

Expisoft AB is a privately held Swedish cybersecurity company headquartered in Täby, Sweden, founded in 2008 by Fredrik Simonsson and Stefan Gustafsson as a spin-out from Steria. Its product portfolio rests on two integrated layers. The first is a self-developed PKI and Certificate Authority infrastructure (ExpiTrust EID CA v4, EDIEL CA v3, e-Tjänstelegitimationer Fil/Kort CAs, ExpiTrust EasyID), distributed via a self-serve web portal at eid.expisoft.se and serving any Swedish organization needing e-service credentials, server/organization/stamp certificates, EDIEL energy-market certificates, Swedbank Open Banking certificates, dental-care support certificates, and administrative services. The second is a high-security IT-infrastructure product family — IT-Bunker (isolated multi-user cybersecurity platform), IT-Värn (network-disconnected, RÖS/TEMPEST-adapted hardened workstation), and IT-Valv (24/7-monitored high-availability vault) — built on proprietary components (SITS/ExpiAccess, ExpiClient, IMPEX, PaaS) and targeted at defense, government, and critical-infrastructure customers. Supporting services include cybersecurity consulting for risk, vulnerability, security-architecture, IT/OT segmentation, and regulatory compliance.

The company monetizes through three mechanisms: per-unit one-time certificate licensing at price points ranging from 550 SEK to 8,270 SEK (with public-sector discounts on Swedbank and Open Banking certificates), recurring managed-service contracts for the IT-Bunker/IT-Värn/IT-Valv platforms, and professional-services consulting engagements. Distribution is dual-mode: the eid.expisoft.se portal handles certificate sales on a self-serve basis with ordering by authorized signatory (digital signing via Kivra or paper), while high-security infrastructure and consulting business flows through direct enterprise sales ([email protected]) targeting Försvarsmakten, FMV, Svenska Kraftnät, municipalities, and energy sector operators.

Expisoft is ISO 27001 certified and holds the highest Swedish credit rating (AAA). The company traces its technical lineage to Swedish defense industry identity and security products dating to the early 1990s, and following Sweden's 2024 NATO accession has restructured development priorities toward international defense and NATO interoperability requirements. The company has no disclosed subsidiaries, no funding rounds, no acquisitions, and no public revenue figures.

Name

Expisoft

Legal name

Expisoft AB

Website

https://expisoft.se

Company type

Private

Founded year

2008

Operating status

Operating

Headcount range

1–10 employees

Short description

Expisoft is a Swedish cybersecurity company operating a proprietary PKI/CA infrastructure and delivering hardened IT environments (IT-Bunker, IT-Värn, IT-Valv) for Swedish government agencies, defense organizations, and critical-infrastructure operators.

Ownership category

akta.pro rank

Product category

Public Key Infrastructure (PKI) and Cybersecurity Solutions

NAICS

Computer Systems Design and Related Services (5415), Computer Systems Design and Related Services (54151), Software Publishers (5132)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Device Identity & Certificate-Based Authentication (PKI) (BPAMAEAL)

akta.pro secondary industries

Secure Communications & Encryption for Utility Networks (VPN, PKI, Key Management) (EUADANAG), Key Management, Encryption & Secrets Management (KMS/HSM/Vault) (HDABAHAG), Single Sign-On (SSO) & Federation (SAML/OIDC, Identity Providers) (HDAEAJAB), Data Security & Privacy Services (DLP, Encryption, Privacy Ops) (BPAKAHAM)

Keywords

• PKI digital certificates
• Cybersecurity consulting services
• Public key infrastructure
• Secure IT environments
• Digital identity solutions

Headquarters

HQ city

Täby

HQ country

Sweden

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Operations, Marketing or Sales

Revenue model

1. Digital certificate and e-identification products: Expisoft issues and sells various PKI-based digital certificates and e-identifications including E-service credentials (file and card formats), Server/Organization credentials, Stamp credentials, EDIEL certificates, Dental care support certificates, SDK functional certificates, and Timestamp certificates. Revenue is generated per certificate issued, with varying prices based on certificate type and validity period. Organizations with Swedish organization numbers order through the eid.expisoft.se portal. Both production and test certificates are available.
2. Cybersecurity infrastructure solutions (IT-Bunker, IT-Värn, IT-Valv): Expisoft delivers hardened IT environments for security-classified information including isolated multi-user platforms (IT-Bunker), air-gapped workstations (IT-Värn), and secure vault services (IT-Valv). These solutions are delivered as managed services with 24/7 monitoring and high availability, tailored for government, defense, and critical infrastructure customers.
3. Cybersecurity consulting: Consultation services including risk and vulnerability analyses, security architecture, IT/OT segmentation, and compliance with standards and security protection legislation.
4. Administrative services and certificate renewals: Change client of order service (850 SEK), order register extracts (950 SEK), new PIN code letters (650 SEK). These ancillary services support the core certificate issuance business.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels3 records

Core offering

Expisoft develops and operates its own PKI (Public Key Infrastructure) and Certificate Authority (CA) infrastructure to issue and manage digital certificates and e-identifications for Swedish legal entities. It complements this with hardened, high-security IT platforms — IT-Bunker (isolated multi-user environment), IT-Värn (network-disconnected, RÖS/TEMPEST-adapted workstation), and IT-Valv (24/7-monitored secure vault) — for handling security-classified information, plus cybersecurity consulting covering risk/vulnerability analysis, security architecture, IT/OT segmentation, and compliance with security protection legislation.

Product overview

Expisoft develops advanced cybersecurity solutions for organizations with high security requirements, centered on a proprietary PKI (Public Key Infrastructure) and CA (Certificate Authority) service. The product portfolio consists of two integrated layers: (1) high-security infrastructure platforms — IT-Bunker (isolated multi-user cybersecurity platform), IT-Värn (network-disconnected hardened workstation with RÖS/TEMPEST protection), IT-Valv (high-security vault with 24/7 monitored infrastructure), and Konsultation (cybersecurity consulting); and (2) a comprehensive suite of PKI-based digital identity products offered via the eid.expisoft.se ordering portal, including ExpiTrust EasyID (personal e-ID without social security number), E-tjänstelegitimation (e-service identification in file and card formats), Serverlegitimation/Organisationslegitimation (server and organization certificates), Stämpellegitimation (stamp/seal certificates), EDIEL certificates (for Svenska Kraftnät energy sector EDI), Tandvårdsstödet (dental care support certificates), test certificates, Swedbank Open Banking API certificates, and administrative services. All products are backed by Expisoft's own CA service and support various Swedish and European government e-services.

Differentiator

Problem solved

Functional benefit

Brands

• ExpiTrust: PKI-based certificate and e-identification brand including ExpiTrust EID CA, ExpiTrust Test CA, ExpiTrust e-Tjanstelegitimationer Fil CA, and ExpiTrust e-Tjanstelegitimationer Kort CA certificate authorities.
• ExpiTrust EasyID
• IT-Bunker
• IT-Värn
• IT-Valv
• ExpiAccess
• ExpiClient

Products and services

• IT-Bunker Isolated and controlled cybersecurity platform that protects organizations' most critical and sensitive information assets through physical/logical isolation, strong authentication, role-based access control, and controlled information flows. Includes components SITS/ExpiAccess secure user environment with thin client, ExpiClient authentication software, IMPEX secure import/export module, and PaaS automated platform for security-standard infrastructure setup. Delivered as a managed service for government, defense, and critical infrastructure customers.
• IT-Värn Network-disconnected, hardware-hardened, RÖS-/TEMPEST-adapted workstation designed to eliminate security risks in protected environments — including remote attacks, data leakage, and electromagnetic eavesdropping. Features total isolation from internet and external networks, strong multi-factor authentication, encrypted storage, and controlled user sessions. Targeted at defense and government organizations handling security-classified information.
• IT-Valv Secure service providing an isolated and controlled multi-user environment for handling sensitive and security-classified information, with robust, segmented, and 24/7-monitored infrastructure and high availability even during crises or heightened preparedness. Built on Design for Defence principles and includes ExpiAccess, controlled import/export, continuous security monitoring, and incident management. Includes support for SDK (DIGG), EDIEL, and other national services.
• Konsultation (Cybersecurity Consulting) Cybersecurity consulting services for security-classified IT and OT environments that help organizations establish and manage robust security structures, comply with laws, reduce risks of information loss and operational disruptions, and achieve safe, stable, and efficient operations of critical systems. Includes risk and vulnerability analyses, security architecture design, IT/OT segmentation, and compliance with standards and security protection legislation.
• ExpiTrust EasyID Personal e-identification that does not contain the holder's social security number (personnummer); the user is identified by a unique identity number added at issuance. Installed with the ExpiClient security software. Validity 2 years. Price 1,512 SEK (incl. VAT). Suitable for individuals without a Swedish personal number and organizations without a Swedish organization number; verified by photo ID upload.
• E-tjänstelegitimation (E-service identification) Personal organizational credentials that link a user to an organization without exposing the holder's social security number; available in two formats: file-based (installed with ExpiClient, 1,210 SEK excl. VAT) and smart card (requires separately ordered card reader, 1,350 SEK excl. VAT). Used for secure login to government and enterprise e-services.
• Serverlegitimation/Organisationslegitimation (Server/Organization identification) Server and organization credentials for secure authentication of systems, servers, and functions, including logging into government e-services and systems. Also known as server certificates or organizational certificates. Sub-types include Serverlegitimation, Organisationslegitimation, Funktionscertifikat, SDK funktionscertifikat 4096 bits, and Tidsstämpel certifikat.
• Stämpellegitimation (Stamp identification) Certificate used for signing and verifying data during transfers to e-services where integrity and traceability are critical. Validity 2 years.
• EDIEL CA v3-certifikat Certificate for actors connected to Svenska Kraftnät, used for encryption of PRODAT messages in the Nordic energy market's electronic data interchange (EDI). Production certificate validity 5 years, priced 8,270 SEK (excl. VAT); EDIEL Test CA v3 certificate validity 6 months, priced 550 SEK. Requires signing by certificate manager registered in EDIEL portal or CEO.
• Tandvårdsstödet (Dental care support certificate) Certificate enabling digital journal systems at dental clinics to communicate securely with Försäkringskassan (Swedish Social Insurance Agency). The function certificate can be used for multiple clinics under the same organization number. Priced 4,070 SEK (excl. VAT).
• Test-certifikat (Test certificates) Test e-identifications/certificates for various applications, including Test Serverlegitimation, Test Stämpellegitimation, Test SDK funktionscertifikat 4096 bits, and Test Tidsstämpel certifikat. Used for testing integrations before deploying production certificates; validity typically 2 years.
• Swedbank API-integration certificates (mTLS and Sign) mTLS and Sign certificates for Swedbank Open Banking services, enabling secure API authentication. Private organization pricing: mTLS 4,620 SEK and Sign 5,300 SEK (excl. VAT). Public sector (municipalities, authorities) pricing: mTLS 3,400 SEK and Sign 3,850 SEK (excl. VAT).
• Administrativa tjänster (Administrative services) Administrative services supporting certificate orders: change client of order (transfer order history from one account to another, 850 SEK) and extract from order register (overview of valid certificates linked to an organization number, 950 SEK).
• Beställ nytt PIN-kodsbrev (Order new PIN letter) Service for ordering a replacement PIN letter for a previously delivered certificate. Priced 650 SEK (excl. VAT).
• CA-tjänst (Certificate Authority Service) Expisoft's proprietary PKI-based Certificate Authority service that underpins all digital identity solutions, ensuring strong authentication and full control over certificates and key management. Built on the ExpiTrust CA hierarchy including ExpiTrust EID CA v4, ExpiTrust e-Tjänstelegitimationer Fil/Kort CA, and test CAs. Available via the eid.expisoft.se ordering portal.

Quantifiable outcome

• Full traceability of all access and activities in secure environments
• +2 more outcomes

Named customers6 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

Feature8 records

Partnerships

Four partnerships are on record, tiered core.

• Svenska KraftnätcoreTechnology or IntegrationSvenska Kraftnät operates the Swedish national power grid and manages the EDIEL system for electronic information exchange in the Nordic energy market. Expisoft issues EDIEL CA v3 certificates (8,270 SEK, 5-year validity) used by energy market actors connected to Svenska Kraftnät for encryption of PRODAT messages. This is a core product offering in Expisoft's certificate portfolio.
• FörsäkringskassancoreTechnology or IntegrationThe Swedish Social Insurance Agency operates multiple e-services requiring secure digital certificates. Expisoft provides dental care support certificates for digital journal systems to communicate securely with Försäkringskassan (4,070 SEK), e-service credentials, and server/organization credentials for services like ELT (electronic time reporting) and SHS (distribution system).
• Skatteverket (Swedish Tax Agency)coreTechnology or IntegrationSkatteverket operates numerous e-services accepting Expisoft certificates: E-transport (file submission), Navet (population registration data), Mina Meddelanden (secure messaging), EMCS (excise movement control), SPAR (personal address register), and Partner-APIs. Expisoft's server and organization credentials enable secure access to these government services.
• DIGG (Myndigheten för digital förvaltning)coreTechnology or IntegrationDIGG (Swedish Agency for Digital Government) operates the SDK (Säker Digital Kommunikation) service. Expisoft issues SDK functional certificates (4096 bits) for secure digital communication with government systems, including both production and test certificates.

Scale indicators2 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• Signicat: Norwegian digital identity and e-signature provider serving banks, government, and enterprises across the Nordics. Competes in the same e-identification and trust services category for regulated customers.
• Nexus Group: Sweden-based provider of PKI, identity, and credentialing solutions for government and enterprise. Direct Nordic competitor with overlapping e-ID, certificate authority, and workforce identity offerings.
• Sectigo: PKI and certificate lifecycle automation vendor serving enterprises and governments. Comparable in certificate issuance, PKI-as-a-service, and IAM-adjacent identity offerings.
• GlobalSign: Specialist PKI and digital identity provider offering managed PKI, e-signatures, and certificate services. Closely comparable in product mix and target customer profile.
• Verisec: Swedish company specializing in PKI-based e-IDs (Freja eID) and identity services. Direct Swedish peer competing for the same municipal, government, and enterprise e-identification use cases.

Broad incumbents

• Thales (formerly Gemalto): Global cybersecurity and digital identity giant offering PKI, HSMs, and IAM platforms. Competes in the same broader identity and certificate infrastructure space but with a vastly larger portfolio.
• DigiCert: World's largest commercial certificate authority providing TLS/SSL, PKI, and IoT identity at scale. Competes for the same enterprise certificate and PKI use cases from a much larger footprint.
• Entrust: Established provider of PKI, digital certificates, and identity solutions with global government and enterprise customers. Overlaps with Expisoft across certificate authority and identity issuance.
• IDEMIA: Global leader in government-issued identity and security, including PKI and credentialing for defense, public sector, and critical infrastructure — direct overlap with Expisoft's defense and government customers.

Regional players

• SSH Communications Security: Nordic cybersecurity vendor focused on encryption, key management, and privileged access. Comparable as a Finnish-headquartered peer serving regulated Nordic enterprises, though more focused on encryption than PKI certificates.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/expisoft-ab/posts/?feedView=all
• Facebookfacebook.com/Expisoft-170216467327

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Expisoft