Norman AI — Compliance Intelligence

Norman AI

Trust & Security Center

All systems operational

Security you can verify.

Norman AI is built in Brussels, hosted in Frankfurt, and governed by EU law. This page gives you real-time visibility into our compliance posture, certifications, and security practices.

Certifications & compliance

Regulation

GDPR

EU-only data residency, no cross-border transfers, right to access and delete supported by tenant.

Compliant by design

Reviewed Apr 2026

Posture

EU data residency

All customer data hosted in Frankfurt (Hetzner backend, Supabase database). No data leaves the EU outside Anthropic AI inference (zero-retention).

In effect

Verified Apr 2026

In progress

ISO 27001

Internal preparation for ISO 27001:2022 certification underway. Not yet audited.

Pre-audit

Targeting 2026

How we protect your data

🇪🇺

EU data residency

All customer data processed and stored in Frankfurt, Germany (EU). No data leaves the EU.

🔒

Zero-retention AI

AI inference via Anthropic with zero data retention. Your compliance data is never used for model training.

🛡️

Encryption at rest & in transit

AES-256 at rest, TLS 1.3 in transit. Database-level encryption via Supabase EU.

✅

SOC 2 audited annually

Independent Type II audit covering security, availability, and confidentiality. Reports available on request.

Subprocessors

7 processors · last updated Apr 2026

Provider