Documentation
Complete product documentation for building, operating, reviewing, and proving a Noru compliance program.
Noru documentation
These are the product docs for the Noru application. They explain what each page is for, where its data comes from, how records relate to the rest of the platform, and how to operate the page as part of a defensible compliance program.
Noru structures compliance work and evidence; it does not make legal, audit, or risk decisions for you. Derived and AI-assisted records must be reviewed against your real systems and obligations.
Overview
How the app is organized and where to start.
Controls
How to own controls and keep evidence mapped.
Assets
Build the asset register the rest of the app connects to.
Data Sources
Provider setup, exact permissions, sync behavior, and troubleshooting.
Security
Certificates and findings.
Privacy
Data map, RoPA, assessments, monitoring, connected apps, and review workflows.
People and vendors
Canonical personnel, awareness, third-party risk, and assessments.
Audit
Internal audits, external audit packages, and the shared calendar.
Trust Center
Publish customer-facing trust content with clear scope.
Quick route for new orgs
- Start with Overview
- Create the baseline on the dashboard (policies, controls, assets, personnel, risks)
- Connect Data Sources for continuous evidence
- Use Audit and Trust Center when you need exports / customer-facing posture
How the product fits together
Noru uses a connected operating model rather than isolated checklists:
- Settings and frameworks define organizational context and the requirement sets in scope.
- Data sources continuously collect system facts, evidence, assets, identities, findings, and privacy signals.
- Personnel, assets, vendors, and the privacy data map describe the people, technology, third parties, and data processing inside that scope.
- Controls, policies, risks, findings, and assessments record what should happen, what can go wrong, what was observed, and how the organization responds.
- Tasks, awareness, internal audit, and review queues turn those records into owned work.
- Evidence, reports, external audit packages, and the trust center communicate the resulting posture.
See Page reference for a route-by-route map of every page under apps/app.
Limits
Noru centralizes and structures the evidence your team produces. It does not:
- make an unsupported system compliant by connecting it
- replace management approval, risk acceptance, or legal judgment
- guarantee an audit outcome without truthful scope, maintained evidence, and operating controls
- narrow third-party access scopes beyond what the provider API allows