Norcaster · Trust center
Security, compliance posture, and data-flow transparency for procurement and security reviews.
Readiness, not legal compliance
Norcaster provides runtime policy enforcement and exportable evidence on supported production paths to help teams build EU AI Act readiness and broader AI governance workflows. It is not legal advice, a conformity assessment, CE marking, or a guarantee of regulatory compliance. Risk classification, DPIAs, and legal interpretation remain your responsibility.
Preparation underway; the Type II observation window opens 1 Nov 2026 and the report follows the examination (expected Q2 2027), available under NDA. Not certified today. Separately, customers can already generate SOC 2-scoped evidence bundles for their own examinations — Norcaster evidences the AI-runtime slice; only a licensed CPA firm attests.
Request audit report →Information security management system certification planned after SOC 2 Type II.
Data subject export, deactivation, and erasure flows with audit logging. Standard DPA available.
Data Processing Agreement →Managed Norcaster cloud runs on EU infrastructure in Nuremberg, Germany (Hetzner). Self-hosted Kubernetes available for stricter boundaries.
Encryption, access, incidents, and vulnerability management for reviewers.
Tamper-evident chaining, Rekor anchoring, and independent verification with the bundled standalone verifier.
Live list of infrastructure and service providers.
Current operational status of Norcaster services.
Report vulnerabilities to our security team.
Download our standard DPA or request execution.
Request SOC 2 evidence when available.
| Party | Role | Regions | Data categories | Notes |
|---|---|---|---|---|
| Source code hosting and CI | US, EU | source_code, ci_metadata | — | |
| Cloud infrastructure (managed Norcaster hosting) | EU | customer_payloads, operational_logs, account_metadata | The production cluster runs in Hetzner's Nuremberg, Germany site. | |
Model providers you configure Customer-configured | Inference (OpenAI, Anthropic, Azure OpenAI, Bedrock, etc.) | varies | prompts, completions, embeddings | Customer-selected; data flows per deployment provider binding and DPA. |
| Secondary blockchain timestamp for trace chain Merkle roots | global | sha256_merkle_root_digests | Optional redundancy alongside Rekor; digest-only submissions. | |
| Transparency log for trace chain Merkle roots (hashedrekord; digest only) | US, EU | sha256_merkle_root_digests | Trace chain anchoring (from the Growth plan up) when TRACE_CHAIN_ANCHOR_ENABLED is on. No tenant identifiers in public log entries. | |
| Payment processing and billing | EU, US | billing_pii, payment_metadata | — | |
| Transactional email (address verification, password reset, invitations, security notices) | EU | email_addresses, names, email_content | Added 2026-10-13; in production before then and missing from this list. Hosted in France by the provider's own statement. | |
| Hosting of the web portal (pages and the server functions that relay requests to the Norcaster API) | US, EU | account_metadata, session_tokens, customer_payloads_in_transit | Added 2026-10-13; in production before then and missing from this list. Portal requests pass through its server functions on their way to the API. The function region is a Vercel project setting. | |
| Customer-configured | Embeddings and semantic retrieval | US | text_for_embedding | Only when used for RAG or semantic cache. |
Company & hosting
Norcaster is operated by Navego AB, Lillängsvägen 21, 131 41 Nacka, Stockholm, Sweden.
Questions for security or compliance reviews: security@norcaster.com