Security overview

TLS 1.3 for every connection, AES-256 for everything stored. Encryption keys are held in the EU, in hardware-backed key management, rotated on schedule.

Default: a dedicated, single-tenant environment in Stockholm (eu-north-1). Sensitive clients may choose our sovereign cloud — NorseAI's private cloud at Evroc AB, Sweden, where data stays in Sweden. Deployment inside your own infrastructure, including air-gapped, is a separate option priced per deployment; there your data never leaves your environment.

Identity via verified work email with MFA (authenticator app). Internally: role-based, least-privilege access; every access to client data is logged and available to you upon request.

The following subprocessors process personal data to deliver Round Table: Supabase (EU, AWS Stockholm eu-north-1) — authentication and database; Vercel — application hosting and cookieless analytics; Anthropic — hosted model inference for the EU cloud tier; Resend — transactional email; Microsoft — calendar holds for booking. Sessions delivered on the sovereign-cloud tier (Sweden) run on NorseAI's private cloud at Evroc AB, where Evroc AB acts as infrastructure subprocessor for that tier. On-premises and air-gapped deployments (client premises) do not send session content to the hosted model provider. Any change of subprocessor requires 30 days' prior written notice and gives you a right to object. Infrastructure and subprocessors are covered by continuous monitoring and defined incident response.

All agents in a session are disclosed as such (EU AI Act Art. 50). A moderator — a human in the loop — supervises every live session. Your data is never used to train models.

NorseAI AB holds no security certification today: no SOC 2, no ISO 27001. SOC 2 is planned; we do not publish a date for it, and we will not estimate one. No penetration test has been carried out yet. Our subprocessors run their own compliance programmes, published by them — we do not present those as ours. Security questionnaires and audit requests are answered by a person: use Contact, topic “Security & data protection”.

The Round Table hour runs on our own infrastructure, and it leaves data with us: a written transcript of what participants say, attributed by name, the facts and process map built from it, the process description you provide, and sponsor and participant contact details. We hold that as processor under the signed DPA, in the EU, and delete it no later than six months after the session, or within two weeks of your written request. The build works only on synthetic or anonymised data: live data never enters it, and Construct never connects to your systems. What Construct does hold is your Autonomy Map together with the evidence behind it — the facts for each step and verbatim quotes from the session. A process map names your steps, systems, decision rules and who does what, so we treat it as sensitive: same DPA, same encryption, same access control. Once agents are deployed, where your production data sits is your choice: run them in your own cloud or datacentre and we hold none of it; host them in Construct and the data those agents handle is on our infrastructure.

Found a vulnerability? Report it through Contact, topic “Security & data protection”. We acknowledge within 2 business days and do not pursue good-faith research.