The Finnish state runs its digital administration on a centralised estate whose audit layer does not log the queries that matter, whose service quality the National Audit Office found did not meet the targets set for it, and whose underlying infrastructure is majority-owned by American companies subject to American legal compulsion. The estate was not built because no alternative existed. The alternatives were on the market, they were Nordic, they were profitable, and they were available as standard software deployable in weeks. The record of what was available, and what was chosen, is set out below.
I. The Off-the-Shelf Alternative
Disclosure: at the time of writing, the author owns CPH:CBRAIN.
cBrain is a Danish software company listed on Nasdaq Copenhagen. Its product, F2, is a commercial off-the-shelf (COTS) platform built specifically for government case and document management. It was developed in close collaboration with the Danish ministries over more than twenty years, and it is configurable without custom coding or heavy consulting.
The deployment record is the relevant fact. More than 75 Danish government authorities, including most ministries, use F2 as their platform. It has been deployed by government organisations on five continents, with named clients in Egypt, France, Germany, Ghana, Guyana, Kenya, Romania, Ukraine, and the United Arab Emirates. For two Danish ministries, the F2 ministry solution was “installed and configured, ready to go live within only 3 weeks”. For the Kenyan Ministry of Information, Communications, and the Digital Economy, the platform was configured and deployed within 10 weeks.
The international expansion is current and documented. In August 2026, the Governor’s Office of Land Use and Climate Innovation in California contracted with cBrain through the state’s SLP software acquisition framework, on a five-year term, to modernise its environmental document repository and build an AI-based public interface on the F2 platform. In June 2026, a study published by the European Commission’s Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs identified F2 as a leading digital platform for environmental permitting and awarded it the highest digital maturity score among the solutions assessed. In July 2026, the White House Council on Environmental Quality selected F2 to showcase at its inaugural Permitting Innovators Expo.
The supplier is mature and profitable. Revenue was DKK 268 million in 2024 and DKK 251 million in 2025, a six per cent decline reflecting delays in large government projects, while subscription revenue grew approximately 18 per cent and reached 66 per cent of total revenue. Earnings before tax were DKK 56 million, an EBT margin of 22 per cent, and the board proposed a 56 per cent increase in dividends to DKK 1.00 per share. The 2026 forecast is revenue of DKK 275–290 million at an EBT margin of 20–25 per cent.
This is standard software, sold as a product, deployable in weeks, from a listed Nordic supplier. It is not a bespoke construction project.
II. The Domestic Alternatives
Finland has its own suppliers, and they have already delivered the same class of system to the Finnish state.
Tieto (now Tietoevry) supplies Public 360°, a case, document, and archive management platform described by its vendor as setting “the standard for public case management in the Nordics”. The State Treasury selected Tieto to deliver its case management system in a 2015 tender, with delivery in early 2016. In February 2017, the Finnish Prime Minister’s Office, the Government ICT Centre Valtori, and Tieto signed an agreement to digitalise case and document management across the ministries and government agencies, using Public 360° as the standardised solution. The first phase replaced the systems of all ministries, the Office of the President, and the Chancellor of Justice with a single Tieto 360° solution; the next phase opened the solution to approximately 80 government agencies through the Valtori framework agreement. By May 2022, all 12 ministries were using the common case management system, VAHVA, together with a digital signature. Fimea, the Finnish Medicines Agency, deployed the same product as VirastoVahva, described as based on the “information-secure and certified TietoEVRY Public 360° product”.
Notice how the secure off the shelf software suite is used for internal government document management, while the citizens are left with the insecure patchwork.
The Two Estates
Valtori is not one architecture. It is one provider with two business areas, and the separation is legal, not merely technical. The TUVE business area is the high-readiness security network for the authorities; the law requires it to be production-wise, administratively, and economically separate from the ordinary government ICT services. The TORI business area is the ordinary government ICT service, and the public internet layer sits inside it, facing citizens.
The secure internal estate serves the state’s own officials. It is the case and document management system that runs across the ministries, the Office of the President, the Chancellor of Justice, and approximately eighty government agencies. It is VAHVA, built on Tieto Public 360°, and its vendor describes the underlying product as the “information-secure and certified” platform. It is the system in which ministries prepare decisions, manage correspondence, and keep the documentary record of government. The state bought the certified product for its own desks.
The insecure external estate serves the citizens. It is the public internet layer that Valtori shuts down as a precaution when a vulnerability is disclosed, and it is the layer on which the citizen-facing registers sit. It is Kela’s benefit administration, running on Salesforce and integrated by PwC, at a comparison price of EUR 589 million over ten years. It is the Tax Administration’s taxpayer data on Microsoft Azure. It is the 64 per cent of digital public services that the Aalto University research found running on American-owned infrastructure. It is the citizens’ records—health, benefits, taxes, votes—sitting on the layer that is subject to the CLOUD Act.
The same state, through the same provider, in the same years, bought the certified Nordic product for its own document management and left the citizens’ records on the American platform. The separation is not a market outcome and it is not a capacity constraint. Valtori’s TUVE and TORI business areas are legally distinct, and the certified product was placed in the one that serves officials. The citizens were left on the other.
The consequence is a hierarchy of protection. The official’s document is protected by a certified Nordic platform inside the security network. The citizen’s record is protected by a contract with an American provider whose obligations run to the American government first. The state protected its own correspondence more carefully than it protected the population it governs.
Visma is the second domestic option. Its public administration finance platform, Solveon by Visma Aquila, is described as “one of the most widely used finance management platforms across Finnish public administration, already in use across more than 100 organisations in both the public and private sector”. Visma Consulting Finland closed its largest single contract in the company’s history with KEHA, the nationwide CRM system for the unemployment offices and local government organisations that support Finnish enterprises, worth EUR 10 million.
A Finnish supplier with a certified case management product, deployed across all twelve ministries and eighty agencies, is not a hypothetical. It is the installed base.
III. The American Dependency
The infrastructure layer is different, and the dependency there is documented at scale.
Research conducted by Aalto University and reported by Helsingin Sanomat found that 64 per cent of digital public services provided by Finnish authorities run on infrastructure operated by US-based companies. Within that figure, Amazon Web Services carries 45 per cent, Microsoft Azure 18 per cent, and Google Cloud under 2 per cent. In 2024 alone, Finnish public authorities signed agreements for Microsoft licences and usage rights worth EUR 1.17 billion.
The migration of sensitive data is current and specific. Kela, the Social Insurance Institution, is transferring health data to American data centres, including information on therapy reimbursements and parental leave. The Tax Administration is moving residents’ tax data to Microsoft Azure. The Ministry of Justice decided in spring 2025 to build the new election data system on an AWS production platform, covering candidate data, voter data, and vote counting. In March 2026, the ministry reversed that decision; the new electoral information system will be hosted in a data centre in Finland, and the existing system will continue to run on domestic servers until after the April 2027 general election. The reforms across Kela and the Tax Administration are scheduled to take effect by 2027.
IV. Kela’s Eepos Programme and the Salesforce Procurement
The clearest case of the dependency is not the infrastructure layer but the application layer, and the clearest example is Kela’s benefit administration reform.
Kela selected PwC as its strategic partner and Salesforce as the technology platform for the Eepos programme, a reform of Kela’s benefit administration systems and services. The procurement’s comparison price, calculated over ten years, is approximately EUR 589 million. PwC assembled a cross-territorial team of approximately 350 people from PwC Italy, PwC UK, and PwC Finland, including 120 professionals from Italy, to design the platform in collaboration with Salesforce.
The scope is the whole of Kela’s benefit processing. Kela handled 18.7 million benefit applications last year and paid an average of EUR 3,000 to every resident of Finland. Processing is still largely manual, with only 20–40 per cent of decisions automated. The Eepos programme is intended to automate 80 per cent of applications. The Director General of Kela, Kari-Pekka Mäki-Lohiluoma, estimated that the programme could reduce Kela’s workforce by about one thousand employees, slightly more than 10 per cent of the current staff of approximately 8,000, of whom 6,000 process benefit applications. Kela’s CEO, Lasse Lehtonen, said in a podcast interview that the impact assessments are understated, and that the reduction would affect 2,400 people. The payback period for the system is calculated at twelve years.
The programme was launched in 2022 with no stated savings target: the board noted that Eepos was not seeking savings, only the replacement of ageing information systems. Within a year, the board concluded that the programme could achieve 15 per cent cost savings. The first phase will automate rehabilitation benefits, family pensions, and military benefits, which together accounted for EUR 245 million, or less than 1.5 per cent of all Kela benefits last year.
The technology is American. The integration partner is a global consultancy. The platform is a SaaS product whose data is subject to the CLOUD Act. The procurement is the largest in Kela’s history, and it is the clearest instance of the pattern: an application-layer dependency that sits on top of an infrastructure-layer dependency, in a programme whose stated purpose is the automation of the welfare state’s core function.
V. The Jurisdictional Mechanism
The dependency is not a matter of corporate intent. It is a matter of statute.
The US CLOUD Act obliges American technology companies to hand over data in their possession at the request of US authorities, regardless of where in the world the data centre is located. The Foreign Intelligence Surveillance Act provides a parallel route. A European subsidiary of a US-headquartered provider can be compelled to comply with US legislation, so the question is not where the data is physically stored but which jurisdiction applies to it.
The Finnish cybersecurity expert Petteri Järvinen stated the position directly: “In the United States, the position is that if information is important for national security or foreign policy, corporate agreements don’t matter”. He noted that Microsoft announced price increases of 10 to 20 per cent in the same period, and that Germany has spent twenty-five years trying to establish alternatives to Microsoft in municipal services while Denmark has embarked on a similar path.
The Member of the European Parliament Aura Salla warned that the election-data decision “weakens Finland’s crisis resilience” because the CLOUD Act obliges US companies to hand over data on request.
VI. The Valtori Suppliers and the Procurement Pitfalls
The centralised estate is not only an architecture. It is a supplier structure, and the supplier structure has its own record.
Disclosure: at the time of writing, the author owns HEL:SIILI.
Valtori’s supplier base is dominated by a small number of Finnish and international IT houses: Tietoevry, CGI, Gofore, Solita, Fujitsu, Knowit, Siili, and Netcompany, among others. The Finnish IT services market is described as “still dominated by a few legacy IT service houses with TietoEVRY and CGI leading the group”, with Valtori as “a major provider to the public sector”. In 2025, Valtori ran internal competitions within Hansel’s dynamic purchasing system for three major cloud capacity providers. Valtori selected Gofore for its testing consulting framework agreement for three years with a two-year extension option, and for its identity and access management expert services framework agreement for two years with two one-year extension options, with a total value of EUR 11–13 million. The same year, Tietoevry Tech Services continued as the supplier of data centre and capacity services under a framework agreement originally competed by Hansel in 2012 for the years 2013–2019.
The pitfalls are documented by the National Audit Office and by the market court.
The 2026 audit, to be published on 7 April 2027, will examine whether Valtori’s service procurement is based on valid contracts concluded following appropriate tendering processes, whether the cost accounting procedures underlying the pricing of services are sound, and whether sales invoicing is based on concluded service contracts and applicable price lists. Valtori’s revenue from service operations in 2025 was approximately EUR 470 million, and its service purchases approximately EUR 193 million.
The market court has already ruled on one procurement. In November 2025, the Market Court annulled Valtori’s decision to select Gofore as the supplier of AWS cloud capacity distribution and management services, in a procurement worth EUR 54 million, and prohibited Valtori from concluding the contract under threat of a EUR 1.5 million fine.
The supplier management process has been described but not implemented. A Ministry of Finance evaluation found that “the process for supplier management has been described, but it has not been put into practice”. “Supplier management varies depending on the service model, so a single process does not necessarily support the target state.” In customer-specific services, “there are no clear guidelines for decisions related to supplier management”. On the TUVE side, “the customer may have to do the service integration itself and manage the supplier, even though the contract and responsibility are with Valtori”. In certain delivery models, “customers do not have direct contacts with the supplier, but Valtori is an intermediary layer without creating any added value”. And where Valtori manages services in which the substantive expertise sits with the customer, “the problem is accentuated”.
A follow-up audit found that Valtori’s contract management still had problems. The 2019 audit found that Valtori’s service quality did not meet the quality targets set in the TORI Act, nor customers’ needs, and that the savings and customer-experience goals for the services transferred from the agencies had not been achieved at the time of audit. A 2021 follow-up found that the Ministry of Finance had changed Valtori’s steering to better account for service quality and operating costs, and that Valtori had brought its service processes and services to a level “that can be considered to correspond better to the situation at the time of the audit” than before.
The pattern is structural. A centralised procurement body with a concentrated supplier base, an audit office that has found the quality targets unmet, a market court that has annulled a major award, and a supplier-management process that has been described but not implemented. The off-the-shelf alternative exists, and it is sold by a company whose revenue depends on the product working across many customers. The Valtori model is a procurement layer whose revenue depends on the services being purchased through it. Those are different incentives, and the audit record is the evidence of which one has produced the outcomes.
VII. The Suppliers Were Not the Constraint
The suppliers who built the Valtori estate are the same suppliers who sell the working products.
Tietoevry supplied the certified Public 360° platform that all twelve Finnish ministries now use, and it also supplied services through Valtori under the framework agreements examined by the National Audit Office. CGI is the other dominant supplier in the Finnish public sector, with a long record of delivering government systems. Gofore was selected by Valtori for the testing and identity management frameworks and was the intended supplier of the EUR 54 million AWS capacity award that the Market Court annulled. These are not firms incapable of delivering secure, functioning systems. They are firms that have delivered such systems, to the same state, in the same decade.
The failures documented in the audit reports therefore cannot be attributed to a supplier capability gap. A supplier who can deliver Public 360° to twelve ministries and eighty agencies can deliver a case management system to Valtori, because the product already exists and the deployment model already works. A supplier who wins a framework agreement for testing consulting can deliver testing consulting, because that is what the framework describes.
What the audit reports document is something else: quality targets that were not met, savings that were not realised, a supplier management process described but not implemented, a customer that in certain delivery models has no direct contact with the supplier, and an intermediary layer that in the audit office’s own words creates no added value. Those are properties of the specification and the procurement design, not of the supplier’s capacity.
The consequence is that accountability has nowhere to land. The supplier delivered what was specified. The specification was written by the procurement body. The procurement body’s performance was audited, and the audit found the targets unmet. The audit found that the steering was unclear and the supplier management was not in practice. And the customer, in several delivery models, was left without a direct relationship to the supplier whose services it was paying for. Every party discharged its own part, and no party is answerable for the estate.
That is the travesty, and it is precise. The solutions existed, from these suppliers, in these years, at these prices. The state bought the project form instead of the product form, from the same firms that sell the product form, and it bought it through a procurement layer that the audit office found had not implemented supplier management and had in some models become an intermediary creating no added value. The supplier cannot be blamed, because the supplier was not asked for the product. The procurement body cannot be blamed in any way that lands, because its part was discharged in the procurement record and the audit reports are advisory. The customer cannot be blamed, because in several models the customer had no direct relationship with the supplier at all.
The estate is insecure not because anyone was incapable. It is insecure because the design choice was bad, and the design choice was made in a form that leaves no one holding it.
VIII. The Choice
The alternatives are listed on Nasdaq Copenhagen and Nasdaq Helsinki. They are deployed in Danish ministries in three weeks and in the Kenyan ICT ministry in ten. They are used by more than 75 Danish government authorities and by all twelve Finnish ministries. They are sold by a company with a 22 per cent EBT margin and a Finnish supplier with a certified product and an installed base across eighty agencies.
The infrastructure layer, by contrast, runs 64 per cent on American-owned systems, carries a statutory disclosure obligation the Finnish state cannot contract out of, and in 2024 cost EUR 1.17 billion in Microsoft licences alone. The application layer is following the same path: Kela’s Eepos programme, at EUR 589 million over ten years, built on Salesforce and integrated by PwC, automating the core function of the welfare state on a platform subject to American legal compulsion.
The architecture is not a market outcome. It is the result of specific procurement decisions, made while the alternatives were available, and repeated across Kela, the Tax Administration, and the Ministry of Justice before the election-data decision was reversed. The shelf was stocked. The record shows who did not reach for it, and it shows what was reached for instead.
References
Aura Salla. (2026, January 24). MEP Aura Salla: Suomen Kela ei voi valita yhdysvaltalaista pilveä.
cBrain. (2025). Investor information: A proven platform built for government.
cBrain. (2026, February 19). cBrain delivers a solid EBT margin of 22% and increases dividends by 56% (Company Announcement No. 03/2026).
cBrain. (2026, August 18). cBrain awarded first contract with the State of California (Company Announcement No. 08/2026).
cBrain. (2025, January 22). New Danish Ministry implements F2 (Press Release No. 1/2025).
cBrain. (2024, October 10). cBrain implements F2 for two new Danish ministries in just 3 weeks (Press Release No. 9/2024).
cBrain. (2025). Elm and cBrain partner to accelerate government digital transformation in the region.
Digitalisation World. (2017, February 27). The Finnish Prime Minister’s Office chooses Tieto.
Digitalisation World. (2019, June 17). The Norwegian Ministries choose Tieto as supplier of new core system.
DPL Africa. (2025). Digital transformation for ministries, done in weeks.
GlobeNewswire. (2026, January 14). cBrain signs partner agreement with Publica AI in Nigeria, supporting international growth strategy.
GlobeNewswire. (2025). cBrain aims to create and lead two new global solution niches.
Gofore. (2026, July 13). Gofore Plc’s Business Review for June 2026: Net sales 19.6 million euros.
Kela. (2025, April 22). PricewaterhouseCoopers Business Services SRL (PwC) on valittu Kelan etuuskäsittelyn uudistuksen toteuttajaksi.
Kela. (2025). Nina Nissilä: Kelan laaja järjestelmäuudistus merkitsee asiakkaalle parempaa palvelua ja nopeampia päätöksiä.
LinkedIn / Terhi Sorvali. (2026, May 11). Solveon by Visma Aquila: finance management platform in use across more than 100 organisations.
Markkinaoikeus. (2025, November 20). MAO: Valtori – Gofore AWS-pilvikapasiteetin jakelu- ja hallintapalvelu.
Ministry of Finance, Finland. (2019, February 27). Målsättningarna för statens centraliserade ICT-tjänster har ännu inte uppnåtts helt (VTV).
Ministry of Finance, Finland. (2021, March 1). Palkeet ja Valtori – Arviointi, loppuraportti.
Tieto. (n.d.). Public sector: Public 360°.
Tieto. (2020, June 16). Fimea introduces VirastoVahva system to streamline and optimize case management.
Tivi. (2015, September 14). Tieto voitti kilpailutuksen: myy Valtiokonttorille asianhallintaa.
Tivi. (2025, November 20). Valtion it-keskus mokasi 54 miljoonan euron kilpailutuksessa – Goforen voitto kaatui oikeudessa.
UpCloud. (2026, February 20). Who’s really in control of your cloud data?
Valtioneuvosto. (2022, November 28). Valtioneuvosto ja kaikki sen ministeriöt siirtyneet yhteiseen asianhallintaan.
Valtori. (2020, June 10). Sujuvuutta asianhallintaan VirastoVahvalla.
Valtiontalouden tarkastusvirasto (VTV). (2019). Kertomusluonnoksesta annetut lausunnot: Valtorin palvelujen laatu.
Valtiontalouden tarkastusvirasto (VTV). (2021, November 9). Jälkiseurantaraportti: Keskitetyt ICT-palvelut ja -hankinnat.
Valtiontalouden tarkastusvirasto (VTV). (2026, October 14). Government ICT Centre Valtori’s procurements and contract management.
Visma. (2025, February 28). Visma kehittää uusia ulkoistuspalvelukumppanuuksia Solveon-tuoteportfoliolle.
Yle. (2026, January 26). Expert sounds alarm over risks of US tech dependence.
Yle. (2026, April 26). Finland to keep election data at home after all.
Yle. (2026, March 24). Justitieministeriet drar tillbaka beslut om att ta i bruk amerikansk molntjänst.
Yle. (2026, February 26). Kela aikoo automatisoida 80 prosenttia etuuspäätöksistään – taustalla 589 miljoonan euron Salesforce-järjestelmä.