Security & Trust

• SOC 2 Type II — preparation underway; observation window opens Nov 2026 (no Type I planned). Not certified today.
• ISO 27001 — on roadmap after SOC 2 Type II.
• ISO 42001 — planned; not started.
• Third-party penetration test — planned to run inside the Type II observation window (PEN-01); not yet booked, no completed report published.

Managed Norcaster cloud runs on EU infrastructure in Nuremberg, Germany (Hetzner). Self-hosted Kubernetes available for stricter boundaries. Norcaster is operated by Navego AB, Stockholm, Sweden.

• Managed cloud — EU infrastructure in Nuremberg, Germany (Hetzner) by default. EU-only regions today; confirm region and provider configuration before production rollout.
• Self-hosted / private deployment — Kubernetes deployment available for teams that need stricter network boundaries. See self-hosted setup.

• TLS for data in transit between clients and Norcaster services.
• Provider credentials and integration tokens encrypted at rest (Fernet).
• Encrypted Postgres backups with dedicated backup encryption keys.
• Enforcement audit exports can include a signed hash chain when AUDIT_SIGNING_KEY is configured.

• Organization-scoped data and API access — resources are tied to org membership and role checks.
• Role-based access within organizations (owner, admin, member, viewer).
• Multi-factor authentication (TOTP) for user accounts; optional org-wide MFA requirement.
• API keys with scopes, optional expiry, revocation, and last-used metadata.
• OIDC single sign-on with optional password-login lockout per organization.
• Just-in-time production access for platform operators with audit logging.

Technical reference: Security & compliance docs.

• Configurable retention for trace and enforcement data by organization.
• Plan tiers define default audit retention windows; org admins can adjust within plan limits.
• GDPR data subject export, deactivation, and erasure with audit events.

• Severity-based response targets (SEV-1 through SEV-4) with documented playbooks.
• Security event monitoring with alerting for authentication anomalies, privilege changes, and export patterns.
• GDPR breach notification process aligned with 72-hour supervisory authority timelines where applicable.
• Weekly dependency update PRs (Dependabot). CI blocks critical CVEs in our dependencies, and any image with a fixable critical CVE before it is published or deployed.
• Documented remediation SLAs: critical within 7 days, high within 30 days, medium within 90 days.
• Secret scanning in CI; documented exception process for time-bound allowlists.

Report vulnerabilities: responsible disclosure or security@norcaster.com.

• Standard Data Processing Agreement available for download and execution.
• Versioned subprocessor register published from our internal registry.
• Customer-configured model providers (Anthropic, OpenAI, Azure OpenAI, Bedrock, etc.) are part of your data flow when you connect them.

Data Processing Agreement → · Full subprocessor list · JSON API

What a third-party-risk reviewer can and cannot get from Norcaster about the models behind a deployment. Every line is one of recorded, enforced or not verified.

• Which model answered — recorded. Each deployment is bound to one provider model; the run record carries that bound model, never the client's requested name.
• Which models may answer — enforced. A deployment can carry an allowlist of model ids that child scopes may only narrow, and can require an approved model; disabled, unlisted or unapproved models are refused before any provider sees data, with an enforcement event.
• Who approved a model — recorded. Approval status, approver, time and note on the model; every change in the platform audit log.
• Where it runs — enforced from the declared tag. Provider residency allowlists block out-of-region dispatch, fallback included. The tag is compared with the endpoint where that is derivable (AWS region, Mistral's published EU default); a contradiction is shown and, under the fail-closed posture, blocked. This is configured residency, not physical residency evidence.
• Which runtime build answered — recorded where reported. For self-hosted runtimes such as NVIDIA NIM the request records the runtime version and, when the runtime reports it or an operator annotates it, engine and image digest — each labelled with its source.
• Weights, licence, derivation — declared, not verified. Operators can record source, licence, model card, base model, derivation and a declared weights digest. Norcaster does not compute or verify weights digests and does not detect distillation.

Norcaster's tamper-evident trace model gives security and audit teams independently verifiable runtime records — without asking reviewers to trust our word alone.

• Per-organization append-only SHA-256 hash chains for enforcement and run-seal events.
• Segment roots published to Sigstore Rekor (public transparency log) for external anchoring.
• Standalone verify_audit_bundle.py verifier ships in every bundle zip — verify audit bundles without Norcaster API credentials. A separate @norcaster/verify CLI for per-run trace-proof bundles is pending npm publication.
• Signed enforcement-event exports and audit bundles with bundled verification instructions (HOW_TO_VERIFY.txt).

Cryptographic chaining attests to ledger continuity, not business truth or legal compliance. Pre-cutover events may be marked pre-chain and are outside the ledger.

Trace integrity details → · Trust center