Infrastructure security
Encryption in transit & at rest
TLS 1.2+ in transit; AES-256 at rest via Supabase.
Tenant isolation
Postgres Row-Level Security is enforced at the database layer.
Controls
Reviewed Jul 15, 2026Product & access security
Access control & audit logging
Scoped roles; security-relevant actions are audit-logged.
Vulnerability monitoring
Dependabot alerts and automated security fixes are enabled.
Incident response
Breach notification
Affected customers are notified without undue delay; internal escalation targets support applicable regulatory timelines.
Assurance roadmap
SOC 2 Type II
In progressTargeted; Norami is not yet certified.
Third-party penetration test
PlannedScheduled near the first enterprise close.
Compliance
Privacy policyProcessor posture
Norami (AI BLU, LLC) acts as a data processor for customer data.
GDPR customer DPA
In placeProcessor-signed DPA published; it becomes binding when accepted by the customer.
EU→US transfer basis
In placeEU SCCs (Module 2) are included in the DPA; a Transfer Impact Assessment is maintained.
Sub-processor transparency
In placePublic list with 10 business days’ notice.
Data-subject rights
In placeAccess, export, and erasure are implemented.
Record of Processing Activities
In progressThe internal Article 30 record is being finalized.
EU Representative
PlannedApplicability review and appointment before targeted EU offering.
US infrastructure. EU transfers rely on SCCs + a TIA, not EU data residency or DPF certification.
Resources
Request a documentPublic
Assurance
- SOC 2 Type II reportNot yet available
- Penetration test reportPlanned
Sub-processors
14 listedThird parties that process data on our behalf, the service each provides, and where processing takes place.
Workspace owners receive at least 10 business days' notice before a sub-processor is added or replaced, with a right to object on reasonable grounds.