How data flows, and where humans stay in control.
We explain data handling only where it is supported. Where something is not yet confirmed, we say so rather than overstate it.
Data handling, access and oversight.
Configurable to your policy. Customers remain responsible for policy and final decisions.
Data flow
Messages travel through Bifröst Relay to the engine and back, following the paths you approve.
Data minimisation
Deployment options are designed to move only what is needed for the control to work.
Encryption
Messages are encrypted in transit between connected systems and norse3 components.
Retention
Retention windows for events and evidence are configurable to your policy.
Access
Access to the console and records is role-based and configurable by your administrators.
Tenant separation
Customer conversations, personal data and incidents are not commingled across tenants by default.
Audit logs
Actions in the console are logged to support internal review and assurance.
Human oversight
Escalation and sign-off stay with your people; norse3 does not make final decisions for you.
Quality and AI management, honestly framed.
ISO 9001 & ISO 42001
We operate quality-management and AI-management approaches aligned to these standards. We display verified scope, certifier and validity only once confirmed — we do not present unverified badges.
SOC 2
SOC 2 readiness is a roadmap item, not a certification. We will not claim it until it is achieved and verifiable.
Accountability stays with you
norse3 supports alignment and is designed to reduce risk. It does not make final decisions, approve outcomes or accept accountability on your behalf.
- • You define the policy.
- • You configure the actions.
- • Your reviewers make the calls.
- • norse3 records the evidence.
Some deployment specifics depend on the option you choose and your environment. Where a detail is not yet confirmed for your context, we will tell you rather than overstate our position.