Data Sources
Connect systems to collect compliance evidence with transparent permissions and sync boundaries.
Data sources
Data sources turn compliance evidence from a quarterly collection exercise into an operating system. Noru connects to identity providers, clouds, code hosts, storage platforms, HR tools, security tools, and training systems to collect metadata that supports controls, assets, personnel records, findings, and audit evidence on a recurring schedule.
Security and permissions
How to review connector scopes, credentials, and collection boundaries.
Sync model
How sync jobs run, what happens on failure, and how evidence becomes stale.
Troubleshooting
Common OAuth, API token, RBAC, and stale evidence failure modes.
Provider groups
Identity and HR integrations produce the personnel record, group membership, MFA status, access review, and training acknowledgement evidence that controls over people and access require.
Providers include Google Workspace, Microsoft Entra ID, HaileyHR, and JungleMap.
Recommended connection order
Connect identity first.
Your identity provider is the foundation. It establishes who has access, which groups exist, whether MFA is enforced, and who is an active employee. Most other controls depend on a stable personnel record — connect identity before anything else.
Connect cloud and code systems.
Once personnel are established, add the infrastructure and development platform integrations. These produce the highest volume of automated evidence: IAM configurations, repository settings, branch protection rules, logging status, and network controls.
Connect security tools.
Security scanners and monitoring platforms bring findings and vulnerability signals into the same workflow as your controls. Add these after cloud infrastructure is connected so findings can be mapped to the correct in-scope systems.
Review unmapped evidence and permission warnings.
After the first sync cycle, review the evidence vault for unmapped items and the integration list for permission warnings. Resolve stale evidence and broken integrations before presenting evidence to customers or auditors.
List and detail pages
/data-sources shows available/connected integrations, connection state, evidence count, and current sync
job status. Use it to connect a provider, see whether collection is healthy, and distinguish “not connected”
from “connected but stale/failed.”
Open /data-sources/[id] to configure or reauthenticate one integration, review its provider-specific setup,
start a sync, inspect status and collected evidence, or disconnect it. The URL identifies the integration
record, not merely the provider type, so organizations can keep separate connections where supported.
Before connection, read the scope shown by the setup flow. After the first sync, reconcile the resulting assets, personnel, findings, vendors, and evidence against what you expected the account boundary to contain.