Skip to main content
How can we help?
< All Topics
Print

DORA Factsheet

Performance Store – DORA Factsheet

Version: 1.0 – January 5, 2026
Product: Performance Store
Vendor: So Sequel ApS
Deployment model: 100% On-premises

1. Product and Use Case

Performance Store is an on-premises software product used by companies for:

  • monitoring and auditing of databases and related IT components
  • supporting DORA compliance Articles 17-20 (ICT risk, third-party oversight, logging, access control, patching, etc.)

Performance Store operates exclusively within the customer’s own environment.

2. Architecture and Network

  • Performance Store is installed locally in the customer’s environment
  • No outbound communication
  • No cloud components
  • No remote access from So Sequel ApS
  • No use of subcontractors or outsourced resources

All networking, firewall rules, and segmentation are controlled by the customer.

Performance Store uses Grafana (open-source, on-premises edition) exclusively as a local visualization component. Grafana is provided without cloud services, remote access, data transfer, or support agreements. Therefore, Grafana does not constitute a third-party or subcontractor relationship in the context of DORA.

So Sequel ApS takes responsibility for patching/updating the Grafana version included with the product.

3. Data Handling

  • Performance Store stores exclusively metadata, configuration data, and audit information
  • No personal data is processed by default
  • Data never leaves the customer’s environment
  • Encryption and access protection follow the customer’s own security policies

4. Backup and Restore (Shared Responsibility)

  • The Performance Store database is a standard database located in the customer’s environment
  • Backup, restore, and restore tests are performed by the customer
  • Performance Store supports and documents the customer’s ability to:
    • verify backup status
    • audit configuration and deviations

So Sequel ApS has no operational or backup responsibility for the customer’s installation.

Performance Store supports the customer’s exit strategy through easy access to exporting their own collected metadata and configuration data.

5. Vulnerability Management and Patching

  • So Sequel ApS continuously monitors for vulnerabilities in the product and the included components (including the Grafana version used)
  • Security updates and patches are made available to the customer
  • Since the solution is 100% on-premises, the customer handles the installation of updates in their own environment in accordance with their own change management procedures
  • So Sequel ApS advises the customer on critical vulnerabilities that require rapid action

6. Security and Access Control

  • Security-by-default design
  • Role-Based Access Control (RBAC)
  • Fully auditable access and configuration changes
  • Performance Store monitors and alerts on:
    • unauthorized changes
    • configuration deviations
    • security-relevant events

7. Logging and Audit

Performance Store is designed with full traceability to support DORA’s requirements for monitoring and logging (Articles 10 and 12). The solution provides:

  • Internal Audit Logs: All user activities, login attempts, and configuration changes in Performance Store are logged with a full audit trail (who, what, when).
  • System Monitoring: The solution collects and archives critical events, including unauthorized access attempts and schema changes on the monitored databases.
  • Data Integrity: Since all data is stored on-premises, audit logs are protected by the customer’s own access controls and backup routines, ensuring against unauthorized deletion or manipulation.
  • Compliance Reporting: Built-in dashboards and export options enable the customer to quickly extract documentation for internal auditors or supervisory authorities.
  • SIEM Integration: Data and logs from Performance Store can be exported to the customer’s central log management or SIEM system for correlation and security monitoring.

8. Incident Support and Cooperation (DORA)

In the event of security or operationally related incidents:

  • So Sequel ApS provides documentation, logs, and technical explanations
  • supports the customer’s DORA reporting
  • provides an incident playbook and escalation contact

9. Contractual Terms

  • DORA-relevant obligations are included in the contract
  • Audit and cooperation obligations have been agreed upon
  • No third-party or sub-contractors are involved
  • So Sequel ApS recognizes the right of the customer and relevant supervisory authorities to audit and inspection in accordance with DORA Article 30

10. Contact and Escalation

Vendor: So Sequel ApS
Contact: support@sosequel.com (+45 31 13 12 10)
Escalation: as per contract and incident playbook

Table of Contents