The AI Runtime Control Plane
Find your AI. Protect it. Prove it.
Norcaster finds AI apps your company already runs, puts them behind one control layer, and keeps a record of what they did.
- EU-hosted or self-hosted
- OpenAI- & Anthropic-compatible
- Independently verifiable evidence
01 / Connect
OpenAI- & Anthropic-compatible APIs
02 / Control
AI Runtime Control Plane
Enforce before inference
03 / Execute
Models & providers
Observe & evaluateConnected by request identity
Controls apply on supported production paths, as configured.
01Today, without Norcaster
Every team connects to AI on its own
AI spreads across teams, tools and providers. Without a shared control layer, visibility, policy and evidence stay fragmented.
The fragmented AI estate
Illustrative setupFragmented visibility
AI usage is spread across teams, tools and provider accounts.
Inconsistent controls
Each application follows its own rules instead of one shared policy.
Scattered evidence
Reviewers have to piece together what happened from separate systems.
02With Norcaster
One control layer between your apps and AI
Bring your AI requests through one runtime control plane. Apply policy before the model runs and keep a record of each decision.
Your AI, connected through Norcaster
Architecture overviewCentralized visibility
See requests and decisions for AI routed through Norcaster.
Consistent controls
Apply shared rules before requests reach the model.
Traceable decisions
Keep the policy version, rule and timestamp with each decision.
Start with one application
For each app it is a small change: it sends its AI requests to Norcaster instead of straight to the provider.
03How it works
Three steps
Find
See AI apps you already run.
A small scanner runs on your own systems. It reads your code and network logs and lists the AI apps it finds.
Your code stays with you. Only names and counts are shared.Protect
Put each one behind Norcaster in a few clicks.
Pick the app. Accept the suggested rules. Confirm. Norcaster sets it up and writes the code change for your developers to review.
Nothing changes without a person saying yes.ExampleCustomer chatbot
- Suggested rules
- Enterprise baseline pack
- Approved by
- A person on your team
- Code change
- Ready for your developers to review
Check
See which apps are protected*, and close the gaps.
For apps that still go around Norcaster, your IT team gets ready-made blocking rules. Then we show you whether that traffic stopped.
Your AI appsExample- Customer chatbotProtected*
- Card-dispute summariserStill goes around Norcaster
- Payments agentNot connected yet
Protected means Norcaster saw that app's requests come through in the last 24 hours.
04The result
What you get
One overview
Every connected AI app, who used it and what happened.
Connected AI appsExampleApp Requests, 24 h Blocked or masked Customer chatbot 1,284 37 Back-office tool 312 4 Developer tools 4,906 112 Sensitive data stopped
Personal data and secrets are blocked or masked before they reach the AI.
What the AI receivesExampleYour app sent
Please draft a reply to j.smith@example.com about the refund for order 4471.
The AI received
Please draft a reply to [REDACTED: EMAIL] about the refund for order 4471.
Evidence for your auditor
A tamper-evident record of every decision, ready to export. Included from Growth up.
Evidence recordExample Customer chatbot · production
- Decision
- Allowed, email address masked
- Policy
- Enterprise baseline pack · 1.2.0
- Detected
- Email address
- Action
- Masked before the AI provider
- Provider
- OpenAI · gpt-4o
- Recorded
- 30 Sep 2026, 14:02:11 UTC
Exportable for your auditor · tamper-evident from Growth up
Governed requests leave a defensible record — policy decision, redactions, provider, timestamp, trace ID — exportable as an audit bundle. Norcaster produces the evidence; your advisor renders the judgment. Norcaster does not declare anyone "compliant." Seven evidence artifacts — how proof works →
05Built for regulated companies
Safe to start with
Hosted in the EU
Nuremberg, Germany.
- Operated by
- Navego AB, Sweden
- Subprocessors
- Published list →
Or in your own environment
Run it yourself if you prefer.
- Licence
- Checked locally
- Calls to Norcaster
- None, unless you turn on update checks
Your company login
Single sign-on with your identity provider, on Enterprise plans.
- SAML 2.0
- OpenID Connect
- SCIM 2.0
People who join or leave are synced from your identity provider.
Start in watch-only mode
Record first, block later.
Last 7 days, watch onlyExample
- Requests recorded
- 9,840
- Personal data found
- 52
Watch onlyWarnBlockSet per app. Switch when you are ready.
Each pack's public manifest lists what stays blocked even in watch-only mode. See the manifests →
Security posture
- SOC 2 Type II: Window opens Nov 2026
- ISO 27001: On roadmap
- ISO 42001: Planned
- Third-party penetration test: Planned · in Type II window
- Evidence integrity: Append-only · Rekor
- Deployment: EU-hosted · self-hosted
The AI Runtime Control Plane
Start with one governed AI request.
Run a policy check now, then see how the same control plane deploys, controls, observes, and evaluates production AI.
Try it now
Paste a made-up prompt and see what a real policy pack does with it.
- No signup
- Nothing stored
- No AI provider called
Talk to us
A 20-minute walkthrough of finding, protecting and proving, with time for your questions.
- Pick a time online
- Bring one AI app you run
Security review
What your security team usually asks for, in one place.
- Security posture, stated plainly
- Subprocessor list
- Published detector manifests