The AI Runtime Control Plane

Find your AI. Protect it. Prove it.

Norcaster finds AI apps your company already runs, puts them behind one control layer, and keeps a record of what they did.

Run a policy checkBook a 20-min demo
  • EU-hosted or self-hosted
  • OpenAI- & Anthropic-compatible
  • Independently verifiable evidence
Your AI. One control plane.Architecture overview

01 / Connect

AI applicationsYour product
Agents & copilotsYour assistants
WorkflowsYour AI processes

OpenAI- & Anthropic-compatible APIs

02 / Control

Norcaster

AI Runtime Control Plane

Deployment & policy version
Policy enforcement
PII redaction
Budget controls

Enforce before inference

03 / Execute

Models & providers

OpenAI
Anthropic
Google
Groq
Together
Bedrock
VoyageEmbeddings
Your own models

Observe & evaluateConnected by request identity

Traces & costQuality evalsVerifiable evidence

Controls apply on supported production paths, as configured.

Provider integrations

  • OpenAI
  • Anthropic
  • Google
  • Groq
  • Together
  • Bedrock
  • Voyage
View integrations →

01Today, without Norcaster

Every team connects to AI on its own

  • No overview

    Nobody sees all of it.

  • No shared rules

    Each team decides alone.

  • No proof

    Hard to show what happened.

02With Norcaster

One control layer between your apps and AI

For each app it is a small change: it sends its AI requests to Norcaster instead of straight to the provider.

03How it works

Three steps

  1. Find

    See AI apps you already run.

    A small scanner runs on your own systems. It reads your code and network logs and lists the AI apps it finds.

    Your code stays with you. Only names and counts are shared.

    Shared

    • App and repo names
    • AI providers and models
    • Counts and setting names

    Never shared

    • Source code
    • File paths and line numbers
    • Key values

  2. Protect

    Put each one behind Norcaster in a few clicks.

    Pick the app. Accept the suggested rules. Confirm. Norcaster sets it up and writes the code change for your developers to review.

    Nothing changes without a person saying yes.Example

    Customer chatbot

    Suggested rules
    Enterprise baseline pack
    Approved by
    A person on your team
    Code change
    Ready for your developers to review

  3. Check

    See which apps are protected, and close the gaps.

    For apps that still go around Norcaster, your IT team gets ready-made blocking rules. Then we show you whether that traffic stopped.

    Your AI appsExample
    • Customer chatbotProtected
    • Card-dispute summariserStill goes around Norcaster
    • Payments agentNot connected yet

    Protected means Norcaster saw that app's requests come through in the last 24 hours.

04The result

What you get

  • One overview

    Every connected AI app, who used it and what happened.

    Connected AI appsExample
    AppRequests, 24 hBlocked or masked
    Customer chatbot1,28437
    Back-office tool3124
    Developer tools4,906112

  • Sensitive data stopped

    Personal data and secrets are blocked or masked before they reach the AI.

    What the AI receivesExample

    Your app sent

    Please draft a reply to j.smith@example.com about the refund for order 4471.

    The AI received

    Please draft a reply to [REDACTED: EMAIL] about the refund for order 4471.

  • Evidence for your auditor

    A tamper-evident record of every decision, ready to export. Included from Growth up.

    Evidence recordExample

    Customer chatbot · production

    Decision
    Allowed, email address masked
    Policy
    Enterprise baseline pack · 1.2.0
    Detected
    Email address
    Action
    Masked before the AI provider
    Provider
    OpenAI · gpt-4o
    Recorded
    30 Sep 2026, 14:02:11 UTC

    Exportable for your auditor · tamper-evident from Growth up

Governed requests leave a defensible record — policy decision, redactions, provider, timestamp, trace ID — exportable as an audit bundle. Norcaster produces the evidence; your advisor renders the judgment. Norcaster does not declare anyone "compliant." Seven evidence artifacts — how proof works →

05Built for regulated companies

Safe to start with

  • Hosted in the EU

    Frankfurt, Germany.

    Operated by
    Navego AB, Sweden
    Subprocessors
    Published list →

  • Or in your own environment

    Run it yourself if you prefer.

    Licence
    Checked locally
    Calls to Norcaster
    None, unless you turn on update checks

  • Start in watch-only mode

    Record first, block later.

    Last 7 days, watch onlyExample

    Requests recorded
    9,840
    Personal data found
    52

    Set per app. Switch when you are ready.

    Each pack's public manifest lists what stays blocked even in watch-only mode. See the manifests →

Security posture

  • SOC 2 Type II: Window opens Nov 2026
  • ISO 27001: On roadmap
  • ISO 42001: Planned
  • Third-party penetration test: Planned · in Type II window
  • Evidence integrity: Append-only · Rekor
  • Deployment: EU-hosted · self-hosted
Trust center →

The AI Runtime Control Plane

Start with one governed AI request.

Run a policy check now, then see how the same control plane deploys, controls, observes, and evaluates production AI.

  • Try it now

    Paste a made-up prompt and see what a real policy pack does with it.

    • No signup
    • Nothing stored
    • No AI provider called
    Run a policy check

  • Talk to us

    A 20-minute walkthrough of finding, protecting and proving, with time for your questions.

    • Pick a time online
    • Bring one AI app you run
    Book a 20-min demo

  • Security review

    What your security team usually asks for, in one place.

    • Security posture, stated plainly
    • Subprocessor list
    • Published detector manifests
    Visit the Trust center