Infrastructure security
Encryption in transit & at rest
TLS 1.2+ in transit; AES-256 at rest via Supabase.
Tenant isolation
Postgres Row-Level Security is enforced at the database layer.
Controls
Reviewed Jul 15, 2026Product & access security
Access control & audit logging
Scoped roles; security-relevant actions are audit-logged.
Vulnerability monitoring
Dependabot alerts and automated security fixes are enabled.
Incident response
Breach notification
Affected customers are notified within 72 hours.
Assurance roadmap
SOC 2 Type II
In progressTargeted; Norami is not yet certified.
Third-party penetration test
PlannedScheduled near the first enterprise close.
Compliance
Privacy policyProcessor posture
Norami (AI BLU) acts as a data processor for customer data.
GDPR customer DPA
In progressDrafted; pending counsel sign-off.
EU→US transfer basis
In progressSCCs + Transfer Impact Assessment.
Sub-processor transparency
In placePublic list with 10 business days’ notice.
Data-subject rights
In placeAccess, export, and erasure are implemented.
EU Representative
PlannedBefore EU customer onboarding.
US infrastructure. EU transfers rely on SCCs + a TIA, not EU data residency or DPF certification.
Resources
Request a documentOn request
Assurance
- SOC 2 Type II reportNot yet available
- Penetration test reportPlanned
Sub-processors
11 listedThird parties that process data on our behalf, the service each provides, and where processing takes place.
Workspace owners receive at least 10 business days' notice before a sub-processor is added or replaced, with a right to object on reasonable grounds.