Questions, answered.
Everything compliance, security, technology and operations teams tend to ask about norse3 — the platform, the products and how we handle trust and assurance.
Platform & accountability
Is norse3 an AI model?
norse3 can use narrow models for classification, but its value is the control system around them: rules, policy decisions, enforcement, human review and evidence. It does not replace your model or application.
Who remains accountable for decisions?
Your firm does. norse3 supports alignment and is designed to reduce risk, but people make and own the final decisions in the Heimdall Console.
Whose policies are applied?
Yours. Policies are configured to your jurisdiction, roles, risk appetite and approval thresholds. norse3 provides the mechanism to implement and evidence those decisions — it does not decide your policy for you.
What can the system do when it finds risk?
Depending on policy and integration, it can allow, warn, rewrite, redact, block, hold, quarantine, alert or route to a human reviewer.
How does escalation work?
When an interaction meets an escalation rule, it is routed to a named reviewer with the event, policy and context attached for a human decision. High-impact overrides are attributable and logged.
What evidence is created?
For each handled interaction, norse3 records the event, the policy applied, the action taken, the reason and the timestamp — retained per your settings — distinguishing platform-observed facts from judgement only your firm can provide.
Where does data live?
It depends on the deployment option you choose — hosted, private cloud or customer-controlled — subject to validation of your requirements. We describe the actual data path rather than using one universal privacy claim.
Does norse3 guarantee compliance?
No. It supports compliance and oversight, but your organisation retains accountability and must apply its own legal and regulatory judgement.
Does it work across multiple models?
Yes. norse3 is model-agnostic and applies one consistent control and evidence layer across a multi-model estate, subject to the available integration.
What happens if norse3 is unavailable?
Each workflow has an agreed fail-open, fail-closed or fallback design, together with monitoring, timeouts, queues and manual procedures.
Vör — governed chat
Does Vör replace our AI model?
No. Vör is an independent control layer in front of the model. The model stays separate — Vör controls what it can see, say and do.
Can it stop the AI giving advice it shouldn't?
Yes, where configured. Responses can be held, redacted or escalated to a person before they reach the customer.
What happens with a vulnerable customer?
Vör can detect indicators and escalate the conversation to a named reviewer under your policy.
Do you store conversation content?
Retention is configurable; Vör can operate on a minimal-evidence basis, keeping a reference rather than raw content.
Lögberg — regulated call review
Does Lögberg approve or reject outcomes?
No. Lögberg screens, prioritises and records — the decision stays with your reviewers. It supports oversight, it does not replace it.
Is it FCA-approved?
No product is FCA-approved. Lögberg is designed to support alignment with your obligations; your firm remains accountable.
Does it review every call?
It can screen all captured conversations and surface the material ones for human review, rather than sampling a small percentage.
Skjold & Defence — enterprise AI control
How is Skjold different from Defence?
Skjold focuses on blocking sensitive documents in web AI tools. Defence is the broader runtime-control product for employee AI, copilots and agents — Skjold-style document control is one part of it.
Can Defence stop an agent taking an action?
Where configured, Defence can inspect and block an out-of-policy action before it executes, and escalate to an owner.
Does Skjold retain document content?
No. Skjold scans locally before anything is shared and retains no document content.
Trust & assurance
Which certifications do you hold?
ISO 9001 (quality) and ISO 42001 (AI management) are certified. SOC 2 is a roadmap / readiness item and is not presented as an achieved certification.
Where is data processed and stored?
This depends on your chosen deployment — hosted, private cloud or customer-controlled — confirmed during technical discovery.
Can we review your security documentation?
Yes — security and data-processing documentation is available to qualified prospects under NDA. See the Trust Centre.