Our SOC 2 Type II audit confirms that our security controls operate effectively over time–not just on paper, but in practice.

Data breaches are more frequent, more costly, and more damaging to client trust than ever. For companies that build and manage digital products, the question partners and enterprise clients increasingly ask isn’t whether you take security seriously, it’s how you can prove it. 

SOC 2 Type II is the answer: an independent, structured audit that verifies your security controls actually work, sustained over time.

What SOC 2 Type II actually means

SOC 2 (System and Organization Controls 2) is a voluntary framework developed by the American Institute of Certified Public Accountants (AICPA) for service providers that handle customer data. 

It evaluates organisations against defined Trust Services Criteria, Security being the mandatory baseline, and results in a formal attestation report issued by an independent CPA auditor.

Our SOC 2 journey began with a Type I audit, which assessed whether the right controls were designed and in place – a necessary first step toward establishing baseline compliance. 

Type II goes significantly further: it evaluates whether those controls operate effectively over a sustained period, providing independent confirmation that our security practices are not only well-designed but consistently applied in real-world operations.

What it means for our clients

When a client shares sensitive data or integrates their systems with ours, they shouldn’t have to take our word for it. The SOC 2 Type II report gives them something more useful: a structured, independent record of how we actually handle that responsibility.

An ongoing commitment

SOC 2 Type II isn’t something you achieve and file away. 

Maintaining it requires continuous monitoring, regular audits, and a company-wide discipline around security practices – and that’s exactly how we treat it. For our clients, that means the assurance doesn’t expire.

Infinum’s cybersecurity team provides compliance support, penetration testing, third-party risk management, and secure development advisory for enterprise and regulated-industry clients. Learn more at infinum.com/cybersecurity.

In collaboration with E.ON Hrvatska, we built the first solution on the Croatian market that combines electricity and gas management in a single app and offers AI-powered meter readings.

Energy powers almost every moment of modern life, yet the tools people use to manage it often feel stuck in the past. On the Croatian market, not all energy providers offer a digital experience, and those that do usually provide only basic functionality. For many customers, everyday tasks like checking payment status or submitting meter readings still mean calling customer support or visiting a physical branch.

E.ON Hrvatska saw an opportunity to change that.

Digital experience that matches the energy of a leading brand

E.ON Hrvatska is the Croatian branch of the E.ON Group, one of Europe’s largest energy providers serving more than 47 million customers. The company supplies electricity and gas to households and businesses across Croatia while expanding its portfolio with solar energy solutions and EV-related services.

As an ambitious and fast-growing player on the Croatian market, E.ON wanted its digital presence to reflect its commitment to innovation, customer care, and the green transition. They’re on a mission to push the industry’s boundaries and advance innovation to solve Europe’s most pressing energy challenges. But their existing mobile app didn’t reflect that ambition.

The app offered limited functionality and delivered a frustrating user experience. With low App Store ratings and frequent customer requests for a better solution, it became clear that the app needed a complete rebuild.

Setting a new benchmark for utility apps

In 2025, E.ON Hrvatska partnered with Infinum to redesign and rebuild their mobile platform from scratch. In just five months, we delivered a high-impact MVP that reimagines how customers interact with their energy provider. The new app allows users to track gas and electricity consumption, submit meter readings, and manage their bills within a single, intuitive interface.

By combining a seamless user experience with powerful self-service capabilities, the platform simplifies everyday energy management while reducing pressure on E.ON’s customer support center.

Results followed quickly after launch. App Store ratings more than doubled, a clear signal that customers were finally getting the experience they had been waiting for. Customer behavior shifted as well. All new app users opted for e-billing, directly supporting E.ON Hrvatska’s sustainability agenda.

Smarter energy management powered by AI

The new platform also introduces practical AI features designed to reduce manual input and speed up routine tasks.

Users can now submit gas and electricity meter readings simply by taking a photo. A large language model processes the image, extracts the numbers from the meter, and pre-fills the submission form inside the app. This is especially useful when meters are located in difficult-to-reach places or when lighting conditions make manual entry inconvenient.

The same technology also powers another feature: scanning an ID card to update personal information within the app.

The future looks bright

The collaboration between Infinum and E.ON Hrvatska continues with an ambitious roadmap ahead. Soon, customers will be able to message E.ON directly through the app, pay bills without leaving the platform, receive estimated bill calculations, and request refunds in just a few taps. Future releases will also expand access to smaller B2B customers and introduce real-time tracking for solar energy projects, giving users greater transparency into their transition to renewable energy.

For more details on the project, read the full case study. If your business faces a similar challenge, contact us to learn how we can turn that challenge into an innovative digital product that propels your business forward.

London is full of hidden gems, even on gloomy March evenings, and one recent standout was an exclusive, invite-only evening hosted by Infinum, which brought together the city’s cybersecurity and tech leaders to explore last year’s biggest threats and what lies ahead — featuring perspectives from the NFL, AMR CyberSecurity, and AI governance experts.

The panel featured Kam Karaji, Director of Cybersecurity & Risk Management for the NFL and NFL International Series; Martin Walsham, Director of CyberSecurity at AMR CyberSecurity – Part of Infinum, which Infinum acquired in December 2025; and Eric Alter AI Risk & Governance Consultant at EA AI. Debbie Jones of PRPR agency moderated the discussion.

Sharing perspectives

The conversation covered ground that’s reshaping how organizations think about security: the surge in AI-driven threats, increasingly sophisticated phishing campaigns, and what 2025’s major incidents revealed about modern vulnerabilities.

Infinum has been recognized as an authorized and certified partner in the Databricks Consulting and System Integrator (C&SI) Partner Program, helping organizations implement, migrate to, and scale the Databricks Data Intelligence Platform.

Through this partnership, Infinum will support companies in building modern data platforms and transforming complex data ecosystems into AI-driven insights and intelligent applications.

As organizations continue investing in AI and advanced analytics, many still struggle with fragmented data infrastructure, legacy systems, and complex pipelines that slow innovation. By combining Infinum’s consulting and engineering expertise with the Databricks Data Intelligence Platform, companies can modernize their data architecture, unify analytics and AI workloads, and accelerate data-driven decision-making.

Building intelligent applications brick by brick with Databricks

The Databricks Data Intelligence Platform democratizes access to analytics and intelligent applications by combining customer data with powerful AI models tailored to each organization’s unique business context. Built on a lakehouse architecture with open data formats and governance, the platform ensures that organizations maintain full control over their data.

Through this partnership, Infinum provides consulting, implementation, and engineering services designed to help organizations fully leverage the Databricks platform. 

These services include:

“With organizations looking to unlock the full value of their data, modern platforms like Databricks are becoming critical for scaling analytics and AI,” said Željko Plesac, Infinum’s Partnerships Director. 

“Through our partnership with Databricks, we’re helping companies modernize their data infrastructure and transform their data into actionable insights that drive smarter business decisions.”

By combining Infinum’s expertise in data engineering, cloud, and AI with the capabilities of the Databricks platform, organizations can build scalable data ecosystems that power advanced analytics, machine learning, and next-generation digital products.

The National Cyber Security Centre (NCSC) has introduced a new UK assurance methodology focused on strengthening the cyber resilience of connected products and services. AMR CyberSecurity, Part of Infinum, is now one of only four organisations in the UK authorised to deliver this independent evaluation.

As cyber threats escalate, organisations need clear evidence that the technology they rely on can withstand real-world attacks. The NCSC’s Cyber Resilience Test Facility (CRTF) scheme provides that assurance through structured, independent testing against nationally defined standards.

A new benchmark for independent cyber assurance

Certified Cyber Resilience Test Facilities are authorised to assess connected products using the NCSC’s Principles-Based Assurance (PBA) methodology and its Assurance Principles & Claims (APCs).

In practical terms, this means we independently test how well a product resists cyber attacks through its public interfaces – the points most commonly targeted by threat actors. The outcome is evidence-based assurance that demonstrates real-world resilience, not just policy compliance.

For technology vendors, this provides a credible way to verify security claims and demonstrate alignment with recognised national standards to customers and stakeholders. For buyers, it delivers greater confidence when selecting products and managing supply chain risk.

A trusted position in a select group

CRTF status is awarded only to organisations that can demonstrate proven technical expertise, robust assessment processes, and operational independence.

With only four certified facilities in the UK, this recognition reinforces our position as a trusted authority in cyber resilience testing.

Our services now enable technology vendors to:

“Being one of only four certified Cyber Resilience Test Facilities in the UK is both a significant milestone and a strong endorsement of our technical capability and independence,” said Martin Walsham, Director at AMR CyberSecurity, Part of Infinum.

Why Cyber Resilience Testing matters now

Cyber threats are evolving rapidly, and organisations can no longer rely solely on compliance statements or self-attestation. Independent, structured assurance strengthens supply chain confidence, supports informed procurement decisions, and promotes higher security standards across the UK market.

This certification marks an important step forward in our mission to enhance cyber resilience nationwide. As a certified CRTF, we look forward to working with vendors to build stronger, more secure connected products and contribute to a more resilient digital future. 

If you would like to assess your product’s cyber resilience or understand your third-party cyber risk exposure, contact our senior consultants to learn how we can support you.

We’ve officially earned The Climate Label for 2025. We’re proud to be part of the growing movement to eliminate greenhouse gas emissions under the world’s most trusted climate label. 

After two years as a Climate Neutral Certified brand, we’re entering a new chapter. In 2025, the certification evolved into The Climate Label, a more rigorous framework that moves beyond the traditional “carbon neutrality” model. 

Under the previous model, companies measured their emissions and then purchased carbon credits to “offset” the remaining emissions in order to claim carbon neutrality. Carbon credits are tradable certificates that represent the removal or reduction of one tonne of CO₂ (or equivalent greenhouse gases). They typically fund climate projects such as reforestation, renewable energy development, or methane capture.

The new certification program raises the expectations. It shifts the focus from symbolic balancing to tangible accountability. To earn The Climate Label, companies must introduce an internal carbon fee and use it to fund emissions reductions across their operations and supply chain. They must transparently report their emissions, establish reduction targets, and clearly demonstrate how their funding contributes to real climate impact.

On the road to net zero

Net zero is a global goal aimed at balancing the amount of greenhouse gases emitted with the amount removed from the atmosphere. It is not a one-time milestone, but an ongoing, collective effort that requires consistent action and long-term commitment from governments, industries, and individual companies alike.

As part of that effort, we worked with the Change Climate team to measure our company’s total 2024 carbon footprint, set time-bound Reduction Action Plans, and established a dedicated Climate Transition Budget to invest in carbon projects that met Change Climate’s rigorous Standard.  

Measure

Understanding our impact is the first step toward reducing it. In 2024, our total carbon footprint amounted to 819 tCO₂e — a reduction compared to the previous two years. To arrive at this number, we included all emissions associated with delivering our services, from office energy consumption and hardware use to business travel, employee commuting, and supply chain activities.

Fund

Working with the Change Climate team, we used our total emissions to calculate how much to invest in climate action. We then invested $11,164 directly to reduce emissions in our own operations through a full LED retrofit across our offices. Because electricity is our primary emissions driver, upgrading to energy-efficient lighting is one of the most effective ways to reduce our footprint. 

Reduce

After identifying our main emissions hotspots, we created 12–24 month Reduction Action Plans to further reduce our impact. As a tech company, we do not operate factories or produce physical goods. Our footprint comes primarily from our offices, energy use, business travel, and hardware. That is where we focus our efforts.

By extending the lifecycle of our equipment by more than 50%, we reduce electronic waste and avoid the carbon emissions tied to manufacturing new hardware.

At the same time, we’re strengthening the structure behind our sustainability efforts. With support from the European Bank for Reconstruction and Development (EBRD) through its Blue Ribbon programme, we are working with an approved advisory partner to improve how we track, assess, and report our environmental, social, and governance performance.

This gives us clearer insight into the parameters that matter most, increases transparency, and helps us better understand where we perform well and where we need to improve. By strengthening our ESG governance and reporting today, we are ensuring that our climate efforts remain measurable, focused, and aligned with evolving EU standards.

Advocate

For us, climate responsibility isn’t about earning a shiny certification or improving numbers in a report. It’s about running our business responsibly, setting an example in our industry, and making sure our people are part of this journey. That includes sharing knowledge with our community and supporting our team members in adopting more sustainable practices through education and practical tools.

Additional details about our certification are available on this website and within Change Climate’s public profile directory.

After being named one of North Macedonia’s Best Employers, Infinum Macedonia is taking the next step in strengthening its workplace culture by joining the Macedonian Human Resources Association (MHRA) as a corporate member.

MHRA is the leading professional HR network in the country and an equal member of the European Association for People Management (EAPM). Becoming part of this community reflects our commitment to building better workplaces not just within Infinum, but across the local tech and HR ecosystem.

It’s part of the ongoing work we do every day. Taking care of our people, listening closely, and trying to be a little better than we were yesterday.

From recognition to responsibility

When the Macedonian team joined Infinum in 2021, it clicked quickly. The values were familiar, the way of working felt aligned, and the sense of humor landed somewhere comfortably dark.

A few years on, that early spark has grown into a confident team that’s steadily raising the bar quietly, consistently, and in their own authentic way.

In collaboration with Midtown Athletic Club, we designed and developed a business intelligence platform fit for a premium fitness brand.

If you’ve ever been on a fitness journey, you know the deal: if you’re not tracking, you’re slacking. Achieving your goals, whether that’s gaining muscle, losing weight, or maintaining a healthy lifestyle, starts with tracking your diet, your steps, and your progress.

Running a fitness club is no different. You can’t optimize what you can’t measure. Operational performance and member satisfaction depend on tracking the right metrics: Is that fitness coach underutilized? Why are class bookings dipping in winter? Are peak hours aligned with staff schedules and facility availability?

Reaching that level of insight requires data that’s timely, accurate, and easy to act on. That’s what brought Midtown Athletic Club, a North American high-end fitness brand, to Infinum.

No insight, no gain

Midtown Athletic Club operates eight high-end clubs across the U.S. and Canada, each designed to inspire transformation through movement, community, and personal attention. Their resort-style facilities combine pools, restaurants, hotels, and boutique studios with traditional gym spaces and are packed with high-tech equipment. Cutting-edge technology is a core part of their experience, and they’ve built a reputation for innovation in the industry.

Running an operation this complex generates massive amounts of data. When Midtown came to us, they were sitting on a goldmine of insights buried in fragmented systems, with some data still managed manually in spreadsheets. The analytics tool they had invested in wasn’t meeting expectations, and adoption across teams was low.

Many internal systems suffer from being difficult (or just unpleasant) to use, which leads to adoption issues right off the bat. And the danger of sending good money after bad.

Establishing focus through a discovery workshop

To gain a deeper understanding of Midtown’s pain points and needs, we interviewed their stakeholders. They weren’t just looking for better-looking dashboards or surface-level metrics. What they needed was a business intelligence platform that could empower their team with actionable insights, a single source of truth to align teams, support decision-making, and uncover both inefficiencies and opportunities.

Without reliable data, setting success metrics was difficult, and teams lacked visibility into the bigger picture. But Midtown’s goals went beyond operational efficiency. They wanted to elevate the member experience, build trust in data across the organization, and give every team the tools to make smarter decisions. That meant the ability to compare past and present performance, forecast the future with confidence, and ultimately create a truly data-driven culture.

From scattered spreadsheets to strategic decisions

Together with Midtown, we built a data analytics platform in Microsoft Power BI tailored to their business operations. Now, their team has a centralized, real-time view of their performance across every level, from revenue to memberships. The platform is fast, powerful, intuitive, visually compelling, and built to grow with Midtown. Designed using our purpose-driven design framework, the tool seamlessly works on desktop and mobile, supports users of all skill levels, and reflects Midtown’s premium brand identity.

“The platform gave Midtown a new perspective on their business. They started with a clear idea of which metrics they wanted to track, but through collaboration, we identified additional ones that were just as important. The way they’re looking at membership retention is powered by some fairly complex calculations. It quickly became a key source of insight for how their membership business operates,” explained Chris Cipriano, Infinum’s senior digital producer.

To make data accessible to everyone, we implemented AI-generated summaries to surface key takeaways and trends. We also introduced gamification features, such as leaderboards and team comparisons, to drive collaboration and friendly competition among teams. 

​​Midtown’s president, Jon Brady, played a central role in turning those insights into action. His leadership helped shape a culture where teams feel empowered to use data to drive meaningful impact across the organization. A global leader with over 30 years of industry experience, Jon appeared in our online event series, Delivered, to share his unique approach to leadership and to discuss adopting technology with purpose. Watch the full conversation here.

For more details on the project, read the full case study. If your business faces a similar challenge, contact us to learn how we can help you turn scattered data into a clean system that reveals patterns, delivers valuable insights, and forms a strong foundation for AI.

We don’t usually think of security as something to celebrate.

It’s the part of our work that’s meant to be invisible, without drama, headlines, or surprises. Just the quiet confidence that what we’ve built is secure, compliant, and resilient.

But today, we’re making some noise because Infinum has acquired AMR CyberSecurity.

Teaming up with AMR CyberSecurity

AMR CyberSecurity is a UK-based company with deep expertise in penetration testing and security consulting.

Their team has worked with clients like Zoom, Anglian Water, and English Heritage, often in sectors where the cost of failure is measured in more than just downtime. They hold top-tier security accreditations, and the director, Martin Walsham, sits on the executive board of UK CREST, a global authority in cybersecurity.

Why are we taking this step? Because cybercrime is rising too quickly to ignore, pushing businesses to ensure continuity, meet evolving regulations like NIS2, and protect the trust they’ve worked hard to earn. It’s a shift that brings both responsibility and opportunity for Infinum.