Docs · FAQ
AI governance & evidence — direct answers
The questions buyers, security reviewers, and auditors actually ask — answered the way Norcaster answers everything: evidence, never verdicts.
Can software perform or issue a SOC 2 report?
No. A SOC 2 report can only be performed and issued by a licensed CPA firm under AICPA standards — no software platform can attest, including Norcaster. What software can do is produce the evidence the auditor samples. Norcaster produces the runtime evidence for the AI slice of a SOC 2 examination: boundary enforcement, monitoring, change management, processing integrity, and confidentiality records captured per request on gatewayed AI traffic.
What SOC 2 evidence can Norcaster produce for AI systems?
Nine Trust Services Criteria groups map to the AI runtime, honesty-tagged: runtime-evidenced where a stored field backs the criterion (system boundaries CC6.6–6.7, monitoring CC7.1–7.2, change management CC8.1, processing integrity PI1, confidentiality C1), mixed where runtime records meet an attested process (incident management, availability), and requires-attestation where the judgment is organizational (the access review, risk and vendor programs). A SOC 2 audit bundle adds a criterion-mapping section a CPA firm's workpapers can cite.
Does Norcaster replace Vanta, Drata, or Secureframe?
No — it complements them. A readiness platform covers the organization: laptops, people, policies, org-wide controls. It cannot see inside AI runtime traffic. Norcaster evidences that slice — the requests, redactions, policy decisions, and approvals on gatewayed AI traffic. Two different evidence surfaces, one audit; HR, endpoints, physical security, BCP, and org-wide vendor management remain readiness-platform territory, and Norcaster states that boundary in the product and in every SOC 2 bundle.
Does Norcaster make my company EU AI Act compliant?
No platform can. Compliance determinations require qualified legal counsel and, for certain high-risk systems, a conformity assessment by a notified body. Norcaster produces runtime readiness evidence: enforcement records with pinned policy versions (Art. 9), redaction events (Art. 10), hash-chained record-keeping (Art. 12), approval gates and stop controls (Art. 14), and adversarial-input detection (Art. 15). Its status language is deliberate — evidence captured, controls active — never compliant.
How do auditors verify Norcaster evidence without trusting Norcaster?
Every CSV and PDF audit-bundle export ships with bundle.json, HOW_TO_VERIFY.txt, and a standalone verify_audit_bundle.py script. The script recomputes the manifest content digest and, where trace-chain anchoring is active, confirms segment Merkle roots against the public Sigstore Rekor transparency log — no Norcaster software, account, or API access required.
Can Norcaster govern AI coding assistants like Claude Code?
Yes — the gateway is OpenAI- and Anthropic-compatible, so coding assistants (Claude Code, Codex CLI, IDE extensions) route through the control plane with one API key per developer. Policy is enforced before the provider sees the prompt, blocked and redacted events are recorded per request, and by default only decision-level records are retained — developer prompts are not persisted unless explicitly opted in.
Which obligation frameworks can Norcaster project runtime evidence onto?
Eleven framework views today, all generated from one obligations catalogue: the EU AI Act, SOC 2 Trust Services Criteria, DORA, NIST AI RMF (with the Generative AI Profile), ISO/IEC 27001:2022 Annex A, ISO/IEC 42001 (Annex A controls plus the management-system clauses whose operation leaves records), GDPR, HIPAA (Security and Privacy Rules), PCI DSS v4.0, the Reserve Bank of India's FREE-AI committee report (Norcaster's own mapping of its recommendations, which are not RBI directions), and India's Digital Personal Data Protection Act and Rules (Norcaster's own mapping; the Data Fiduciary duties apply from 13 May 2027). Each view maps the same stored records — decisions, redactions, blocks, approvals, provider attribution, eval runs — onto that framework's rows, tags every row runtime-evidenced, mixed, or requires-attestation, and states what stays outside Norcaster's evidence scope. Regional laws that point at these frameworks (for example Texas TRAIGA's reference to NIST AI RMF) are handled as notes, not as separate catalogues; FREE-AI and the DPDP Act are catalogues because their provisions map row by row onto stored records.
What does "draft mapping" mean on a framework view?
It means Norcaster's reading of that framework against stored runtime evidence has not yet been walked row by row by an external reviewer — a certification body, an audit firm, a supervisor-facing compliance function, or a customer's DPO. The draft sentence is printed on the Obligations Map header and on every audit bundle for that framework until the walkthrough happens, and flipping it is a versioned catalogue change with a changelog entry naming who validated the mapping and when. As of October 2026 every view is Norcaster's own published mapping after an internal row-by-row review recorded in its walkthrough pack, and none has been validated by an external reviewer yet — a view says "validated by" only after that session.
Can Norcaster certify us against ISO/IEC 27001, ISO/IEC 42001, PCI DSS, or HIPAA?
No. Only an accredited certification body certifies against ISO/IEC 27001 or 42001; a Qualified Security Assessor, or the entity's own self-assessment and its acquirer, determine PCI DSS compliance; the covered entity or business associate and HHS OCR determine HIPAA compliance; a controller and its supervisory authority determine GDPR compliance. Norcaster produces the runtime evidence for the AI slice of each of those programmes, prints the boundary on every bundle cover, and never declares anyone compliant or certified.
Does Norcaster run our ISO/IEC 42001 AI management system?
No — the management system is yours. ISO/IEC 42001 sets up your AI management system; Norcaster supplies the runtime evidence that it operates: the Annex A controls plus the clauses whose operation leaves records. Those records are the AI systems in scope, AI objectives measured from stored data, planned changes and the review brought forward when a system's model changes, monitoring, audit-bundle exports for internal audit, management-review packs, incidents with root cause and corrective actions, concerns your members report, and a system information sheet for each AI system. Every clause row is runtime plus attestation: the record is the input, and your organisation attests the judgment. Context, leadership, risk treatment planning, support and continual improvement leave no runtime record and stay outside Norcaster's scope. The mapping is Norcaster's own, with no external validation on record yet, and only an accredited certification body certifies.
Do you cover Texas, Colorado, Korea, Singapore, or my sector regulator?
As profiles, not as catalogues. A jurisdiction or sector profile lists the instruments that apply (with their status, effective date, and whether the fact was verified at the last review), the framework views worth opening, and the duties the existing catalogue rows speak to — with what no stored signal covers stated next to each duty. Today's profiles cover the US federal picture and Texas, Colorado, New York City, California and Illinois, US financial services (SR 11-7, third-party risk, NYDFS), Canada, Brazil, South Korea, Singapore, Japan, Australia, India, Indian financial services (RBI FREE-AI), Hong Kong, the United Kingdom and NIS2. Regional law moves fast, so profiles are dated and reviewed rather than versioned like catalogues, and applicability is always your counsel's call.
Do you map to NIST CSF 2.0, the CSA AI Controls Matrix, OWASP Top 10 for LLM Applications, or MITRE ATLAS?
As crosswalk targets, not as catalogues. The crosswalk groups every catalogue row across all eleven frameworks by the stored record it rests on — decision records, monitoring and detection, minimisation and masking, boundary enforcement, incident inputs, third-party attribution, human oversight, inventory and context, testing, access control, governance documentation, retention — and each theme names the NIST CSF 2.0 subcategories, CSA AICM domains, OWASP LLM risk categories and ATLAS techniques security teams bring to the conversation. A reviewer working from ISO can find the SOC 2, DORA or GDPR row for the same evidence, and the map shows an 'also satisfies' line on every row. NIST CSF 2.0 subcategories are cited on every theme and were verified against the published Core (CSWP 29, February 2024); the other three targets stay marked unverified until confirmed against their published matrices. CSF 2.0 is a self-assessment reference, not an examination program.
Is Norcaster itself SOC 2 certified?
Not yet, and we say so plainly: SOC 2 Type II preparation is underway, the observation window opens November 2026, and the report follows the examination, available under NDA. We deliberately skipped Type I. Meanwhile, EU-hosted and self-hosted deployment options shrink the vendor-risk surface a security review must assess.
Capabilities described as of August 2026. Not legal advice, an attestation, or a compliance assessment. SOC 2 reports are issued exclusively by licensed CPA firms; EU AI Act conformity determinations require qualified counsel.