Kamerakollen handles drawings, surveillance registers and documentation that often describe how our customers' premises are protected. That is why we work actively on security and report openly when something happens – what it concerned, what we did and whether you need to do anything.
How we protect your data
- Encrypted connectionAll traffic to the service is encrypted, and the browser is instructed never to use an unencrypted connection.
- Two-step verificationYour account can be protected with a one-time code from an authenticator app or by email, in addition to your password.
- Protection against password guessingRepeated failed sign-in attempts lock sign-in for increasingly longer periods.
- Separated accountsEvery drawing, project and document is checked against its owner and company every time it is opened or saved. One company cannot see another company's information.
- Protected filesLegitimate interest assessments, photos from annual inspections and reports are stored outside the public parts of the website and are only released to those who are authorised. Shared links can be revoked and expire after a while.
- Protection in the browserThe website only allows content from ourselves and cannot be embedded on other websites, which stops several common types of attack.
- AI on our own serverDrawings analysed by the service's AI features are processed on our own server, not by an external AI service.
- Reviews and updatesThe code is reviewed for security flaws and the website is tested from the outside. We follow the security updates for the platform and the server and install them as soon as they are available.
NIS2 and the Swedish Cybersecurity Act
The Swedish Cybersecurity Act (2025:1506) implements the EU NIS2 Directive in Sweden and has applied since 15 January 2026. It covers organisations in sectors such as energy, transport, health care, water, food, manufacturing and digital infrastructure – most of them from medium size – as well as all municipalities and regions.
Kamerakollen is a small business and is not itself covered by the Act. But many of our users' customers are, and then the camera, alarm and access control systems and their documentation are part of the customer's supply chain. An organisation that is covered must set security requirements for its suppliers.
What you can get from us: a description of how the service is protected (this page), where the data is stored and which subcontractors we use, notice of security events that affect you, and answers to questions about our security measures before an agreement.
For installers there is the NIS2 service in the hub. Its NIS2 documentation tool shows whether the customer is covered, reviews the security system against the requirements of the Act, produces supplier documentation with the equipment from the drawing and keeps track of the deadlines if an incident occurs.
Since 1 July 2026, registrations and incident reports under the Act are received by the Swedish National Cyber Security Centre (NCSC) at FRA.
Security incidents
Here we report security issues that have affected the service or the technology it is built on, and reviews we have carried out.
21 October 2026FixedSeverity: CriticalSerious vulnerability in PHP (PHP2Shell)A serious vulnerability was discovered in PHP, the programming language that Kamerakollen and a large share of the world's websites run on. Our hosting provider disabled the vulnerable function the same day.
What happened?
On 21 October 2026, two vulnerabilities in PHP, together known as PHP2Shell, were published. They could allow an attacker to run their own code on a web server by means of a specially crafted upload, without being signed in. The flaw was in PHP itself, not in Kamerakollen's code, and affected websites all over the world.
What we did
Our hosting provider disabled the vulnerable function on all its servers the same day, before fixed versions of PHP were available. As a result, it was temporarily not possible to upload files, such as floor plans and images. When the fixed versions are available, we will update the server to them, check the website and reopen uploads.
Impact for you
Uploading files was temporarily disabled. We will report the result of the check here when it is complete.
Do you need to do anything?
You do not need to do anything. If an upload failed during this period, you can try again once uploads work again.
Reference: CVE-2026-109618, CVE-2026-109619
1 October 2026FixedSeverity: LowSecurity review and external testWe went through all the code in the service and tested the website from the outside, the way an attacker without an account would.
What happened?
The review covered sign-in, access between accounts, file handling, shared links and the website's protection. The external test showed that no drawing, catalogue, project or report could be reached without signing in. One minor flaw was found: a technical function for embedding pages showed the name of an administrator account.
What we did
The flaw was fixed in the next version of the service.
Impact for you
No customer data could be reached. The account name that was shown did not belong to any customer.
Do you need to do anything?
You do not need to do anything.
24 September 2026FixedSeverity: HighSecurity review during the betaA review of all the code found flaws that were fixed the same day. At the same time, the website's protection was strengthened.
What happened?
Among other things, the review found that two-step verification could be bypassed by someone who already had the account's password, and that access control between companies had gaps where a signed-in user could see some information from other accounts.
What we did
All flaws were fixed the same day. At the same time, an encrypted connection was made mandatory, a security policy was introduced that only allows content from our own website, repeated attempts in forms are now blocked, and sensitive files are stored in protected storage that can only be reached when signed in.
Impact for you
The most serious flaws required an account of one's own or the account's password, and were fixed the same day they were found.
Do you need to do anything?
You do not need to do anything. We recommend that you turn on two-step verification for your account.
Have you found a security vulnerability?
Contact us directly and we will fix it. Describe what you found and how it can be reproduced. Do not include other people's details in the message.
Last updated 21 October 2026.