How Digital Infrastructure Ensures the Reliability of NETS Estonia's Millions of Transactions?

Every day in Estonia, millions of card transactions are made. To ensure worry-free purchases, like a lunch at a café or a bottle of water at a nightclub, payment services must operate flawlessly at all times. AS Nets Estonia, with over 30 years in the business, is a key player in ensuring this. We spoke with Kalle Vaalma, the development director of AS Nets Estonia, about how they ensure IT infrastructure reliability, the volume of transactions they handle, and whether they face fines in case of disruptions.

Card payments are a vital part of our digital economy. Photo: energepic.com

NETS is an excellent example of how a business founded in the early 1990s has successfully evolved to remain competitive today. How would you briefly summarise the NETS story?

AS Nets Estonia, initially known as the Bank Card Center, was established by Estonian banks in 1993. The goal was to reduce costs and facilitate interbank card cross-usage. Connections with Visa and Mastercard were also established for all banks. We later added payment terminals, which we continue to offer. We import hardware, develop software, and rent terminals to merchants.

We were owned by banks until 2008, when the Danish company BBS bought the card center. The name was changed to NETS, marking the start of expansion. We joined with the corresponding center in Norway, acquired a similar business in Finland, and most recently merged with NEXI Group from Italy. We are now one of the largest, if not the largest, in Europe, with over 10,000 employees in the group. AS Nets Estonia operates quite independently within the larger NETS.

If your business is card transactions, would you consider yourself a vital part of the digital economy?

In the specific area of card transactions, undoubtedly.

What proportion of card transactions go through you?

We handle millions of transactions daily. It's difficult to specify our share of all card transactions, as several financial institutions offer the same service and rent out terminals.

So, banks partially buy the service from you and partially do it themselves?

Yes, that's exactly the case. Larger banks tend to opt for group solutions, while smaller ones utilize our services.

Why do clients typically choose you? What are your biggest advantages?

Reliability is our priority. The online services we provide are of critical importance. We must be capable of authorizing card transactions without interruption. Success in this task directly depends on our digital infrastructure and the reliability of the supporting infrastructure.

How have you set up your digital infrastructure to meet these high expectations?

We strongly emphasize redundancy. Our servers, fundamental to our business, must be physically and logically separate. For example, connections to Visa and Mastercard are duplicated in both data centers, meaning we have four parallel connections. If something happens, we can use an alternative solution. The same applies to communication; we use multiple service providers and physically different routes. Hardware is also duplicated, and we avoid single points of failure at the application level.

How do you detect anomalies?

We detect anomalies thanks to thorough monitoring. We have a department that operates 24/7 and responds to every incident.

If your operations were to halt due to a technical reason, how big a fine would you incur?

That's a very good question. Fines exist and they are not insignificant. Short disruptions lead to inquiries, and longer ones to specific sanctions as stipulated in contracts. It's a strict business with little room for error.

In addition to fines, disruptions also result in significant reputational damage, which can ultimately be more decisive, as we are in a trust business. If we can't meet our reliability promise, we simply won't be chosen as a partner.

Have you experienced any disruptions?

Yes. We were once targeted by DDoS attacks and were not prepared at the time. Since then, we've significantly improved our situation. For example, our uptime last year included at least four nines, achieving very high reliability.

Could you outline how you've built your IT infrastructure? What role do data centers and connectivity play in your business?

Our infrastructure is located in Estonia, within physical data centers. We don't use cloud services.

Why have you set aside the cloud?

We've calculated the associated costs, and the cloud is expensive. Our business is linked with Visa and Mastercard, which don't offer cloud-based services in Europe, making it more practical for us to be in data centers. While a hybrid solution could be created, the functions we need are quite expensive in the cloud.

This probably relates to the volume of traffic and transactions?

Yes, that too.

We also need to comply with emergency laws, which require that transactions can still be processed within Estonia if external communication is cut off. This has been a focus for the central bank of Estonia, and we've thoroughly considered reliability for ourselves. This is one reason we keep servers locally.

Your business must meet strict requirements and certifications. Have you also undergone PCI DSS certification at Greenergy Data Centers?

We work hard to pass PCI audits every year. Much of this standard focuses on external aspects, such as processes, policies, responsibility, incident resolution, etc. The technical solution currently operating in GDC is PCI-DSS compliant.

Overall, complying with international standards and regulations is very important to us commercially, as clients highly value this — through us, they can also make their businesses compliant.

What led you to look for a new data center service provider at one point?

Practical need. We once had an office and server room on Laki Street. We moved the staff out 9 years ago, but the server room remained. Naturally, there was also duplication elsewhere. However, the Laki Street facilities were not designed for high-reliability digital infrastructure, and the equipment began to approach the end of its life cycle. Plus, we no longer had our people on site. It wasn't a good situation, so we started looking for alternatives.

How did you come across Greenergy Data Centers?

As you know, maintaining a server room requires resources, constant infrastructure testing and maintenance, and risk mitigation. It's a lot of work. We had to decide whether to build a new server room or find a partner who had already done so. We chose the simpler option.

Thus, we began looking for a new location for our equipment cabinets a few years ago. Key criteria were the distance from another data center and that the new location was built as a data center. Many alternatives were in old buildings not designed for this purpose. That you were new and offered good conditions played a significant role.

Was building your own server room not considered?

No.

So, in summary, the natural life cycle of one server room ended, and you built it from scratch elsewhere?

Exactly.

Besides economic reasons and administrative burden, were there other considerations?

We also considered that international regulations and laws are constantly becoming stricter and companies more aware. It's very common to be asked whether you have certain certifications and whether you comply with various standards and if you are operating on certified green energy. Demands keep growing. It's not our business, and we don't want to constantly monitor these developments and build our infrastructure. It doesn't make sense.

How did the move to Greenergy Data Centers go?

We built a completely new footprint in GDC. Thus, we had three data centers in parallel use for a while, and gradually shut down operations in Laki. We moved in stages over a year and a half. It was a complex project, but we completed it without interruptions.

Do you see further opportunities to benefit from the data center?

The more of our clients that are located in the same building as us, the better. This allows us to establish connections without using the public internet, further enhancing both security and reliability. Direct fibre is always superior.

Have you measured any benefits from being at Greenergy Data Centers?

Compared to running our own server room, being located at your facility is about 20 percent more cost-effective. At least, that's been our experience.