Built for regulated enterprise.
How norse3 approaches security, AI governance, data handling and oversight. Certified where stated; where details require verification they are provided under NDA rather than asserted here.
Independently certified management systems.
ISO 9001
Certified
ISO 42001
Certified
SOC 2
In progress / roadmap
Security, governance and data handling.
Security
Encryption in transit and at rest, hardened infrastructure and least-privilege access. Detailed controls available under NDA.
AI governance
Operated under an ISO 42001 AI management system: versioned policies, monitoring and continual improvement.
Data handling
Configurable inspection, redaction and retention. Sensitive data can be minimised; only a minimal evidence reference retained where appropriate.
Deployment
Hosted, private cloud, in-country sovereign, on-premise or fully air-gapped — matched to your sensitivity and data-residency requirements.
Access controls
Role-based access, authentication and administrative separation of duties.
Human oversight
Escalation routes and named reviewers keep meaningful human control over decisions.
Auditability
Linked, time-stamped records of events, policies, actions and decisions for internal review.
Business continuity
Backup, recovery and resilience practices. Specifics available on request.
Run norse3 wherever your data has to live.
Governance is only useful if it fits your rules. norse3 deploys from managed UK/EU SaaS all the way to sovereign, on-premise and air-gapped environments — so you keep control of where every interaction is processed and stored.
Your data never leaves your chosen jurisdiction.
Where a country requires systems to run on infrastructure inside its own borders, norse3 can be deployed as a dedicated in-country instance — data and processing stay fully onshore. It is a well-understood deployment we can put in place as part of your programme.
- Your data never leaves the jurisdiction you choose.
- Processing and storage stay within your national borders — or on infrastructure you control.
- In customer-controlled and sovereign deployments, no production data is returned to norse3 and we hold no access to your live content.
- Local data-residency and regulatory requirements supported, confirmed during technical discovery.
Illustrative — deploy in the region your data must stay in. UK · EU · UAE · KSA / GCC, or any jurisdiction you require.
Sovereign deployment in 4 steps
A well-understood path we run as part of your programme — typically weeks, not years.
- Step 1
Discovery
We map your data-residency, security and regulatory requirements — which jurisdiction, which controls, who needs access.
- Step 2
In-country design
We agree the hosting location and architecture inside your chosen nation, so data and processing stay fully onshore.
- Step 3
Deploy
norse3 is stood up in your sovereign environment — dedicated, private, on-premise or air-gapped as required.
- Step 4
Assure & operate
Controls are validated, evidence starts flowing, and your team retains oversight with no production data returned to norse3.
norse3-hosted (UK)
Managed SaaS in UK data centres — the fastest route to a controlled environment.
norse3-hosted (EU)
Managed SaaS with European data residency for EU operations.
Your private cloud
Deployed into your own AWS, Azure or GCP account, in the cloud region you choose.
In-country / sovereign
A dedicated deployment on infrastructure inside your own nation, so data and processing stay fully onshore.
On-premise
Runs entirely in your own data centre, fully under your operational control.
Air-gapped
A disconnected deployment for the most sensitive defence and national-security workloads.
norse3 is not a regulator or compliance adviser, and deployment options are confirmed against your specific data-residency and security requirements during technical discovery.
What a real evidence record looks like.
Every intervention produces a linked, time-stamped record. Below is an anonymised, illustrative example — no real customer data.
- Reconstruct exactly what happened, and when
- Show the policy that applied and the action taken
- Record the human reviewer and their decision
- Retain a reference — not the raw sensitive content
Evidence record
- Reference
- EVD-2F41-9C07
- Timestamp (UTC)
- 2026-05-14 09:42:17
- Channel
- Employee copilot
- Risk classification
- Personal data · identity document
- Policy applied
- Restricted identity information v3
- Action taken
- Blocked before submission
- Reviewer
- Reviewer #114 (Compliance)
- Decision
- Upheld — no action required
- Content retained
- None · reference only
- Integrity hash
- sha256:9f2a…c1de
Anonymised, illustrative record. Synthetic data only.
Security documentation.
Available to qualified prospects under NDA.
- Security overview (available under NDA)
- Data processing information
- Sub-processor list
- Deployment & architecture summary
Trust & assurance questions.
Where is data processed and stored?
This depends on your chosen deployment. norse3 can run in the UK, the EU, in your own cloud region, on-premise, or as a dedicated in-country / sovereign deployment — so data and processing stay within the jurisdiction you choose. The specifics are confirmed during technical discovery.
Can norse3 run entirely inside our own country?
Yes. Our in-country / sovereign model deploys norse3 onto infrastructure within your own nation — for example the United Arab Emirates or Saudi Arabia / GCC, as well as the UK and EU. Data and processing stay fully onshore and never leave the jurisdiction, supporting national data-residency requirements.
Can we run norse3 on our own servers, or air-gapped?
Yes. norse3 supports on-premise deployment in your own data centre and fully air-gapped, disconnected environments for the most sensitive defence and national-security workloads.
Do you retain the content of interactions?
Retention is configurable. norse3 can operate on a minimal-evidence basis, retaining a reference rather than raw sensitive content. In customer-controlled and sovereign deployments, no production data is returned to norse3.
Is SOC 2 certified?
SOC 2 is a roadmap / readiness item and is not presented as an achieved certification. ISO 9001 and ISO 42001 are certified.
Can we review your security documentation?
Yes — security and data-processing documentation is available to qualified prospects under NDA.
Need data to stay in a specific country?
Discuss in-country deploymentNeed something specific for your review?
Ask us about deployment, data handling or documentation for your environment.
Discuss your environment