Documents and NDA-gated access
Offer SOC 2 reports, pen test summaries and policies on your trust page, in public or behind an NDA.
What it is
Your trust page can carry documents (a SOC 2 report, a penetration test summary, a DPA, a CAIQ or SIG) next to your approved policies and framework certificates. Each resource has a visibility:
| Visibility | Who sees it listed | Who can download it |
|---|---|---|
| Public | Everyone | Everyone |
| Gated (NDA) | Everyone | Approved viewers who accepted your NDA |
| Hidden | Nobody | Nobody |
Gated resources are what access requests are for. A visitor asks for access, confirms their work email, accepts the NDA you chose, and waits for your decision. Once approved they sign in on your trust domain and the gated resources unlock for them for as long as you allow.
Access requests are rolled out gradually. If you do not see the Access tab in the builder, ask Noru to switch it on for your organization.
Where to find it
Trust CenterBuilderAccess for the settings and the NDA, Trust CenterBuilderSectionsDocuments for the files, and the visibility controls next to each policy under Content → Resources and each framework's Verification & audit info.
Key actions
Switch on access requests
Every change to the agreement is a new version. A requester's acceptance records the version they saw, so editing the text never rewrites what someone agreed to earlier.
Send new requests to Slack
Under Access, enter a channel in Slack channel, such as #security.
When a requester confirms their email, Noru posts their name and company to
that channel with a link to the request; the email address and the reason
stay in Noru. This is in addition to the in-app notification and the email to
admins. It needs Slack connected to Noru (Settings → Integrations) and the
Noru app added to the channel. If the post fails, for example because the
channel was renamed, the other notifications still go out and nothing is
shown in Slack. Clear the field to stop.
Add a document
Gate a policy or a certificate
Policies listed under Content → Resources are public and title-only until you say otherwise. Set a policy to Gated to let approved viewers download it as a PDF, or keep it Public and switch on the download toggle to offer the PDF to everyone. Policies are rendered to PDF from their approved content when downloaded; nothing is uploaded.
Each framework's Verification & audit info has a Certificate visibility dropdown in place of the old "Allow direct download" switch: Public downloads for anyone, Gated releases it to approved viewers (or, with access requests off, to people who ask by email as before), Hidden keeps it off the page.
Watermark gated downloads
With Watermark downloads on (the default), every gated PDF a viewer downloads is stamped on each page with their email address, their company and the download date, diagonally across the page and once more in the bottom margin. This covers uploaded PDFs, policies and certificate files. The file in your storage is never changed; each viewer gets their own stamped copy.
Files Noru cannot stamp are sent as they are, and the access log records a watermark skipped entry with the reason: the file is not a PDF (Word, Excel), is password-protected, is larger than 25 MB, or is not a readable PDF. Public downloads are never stamped, since there is no viewer to name.
Statuses and fields
| Status | Meaning | Set by |
|---|---|---|
Publicpublic | Listed and downloadable by any visitor. | You |
Gated (NDA)gated | Listed with a lock; approved viewers download it. | You |
Hiddenhidden | Not published at all. | You |
Tips and gotchas
Gated files leave your storage only through a viewer's session, and the public page never carries their location. But a PDF, once downloaded, is a file like any other: the NDA, not the software, is what binds the viewer. The watermark tells you whose copy leaked; it is drawn on top of the page and does not stop someone determined from removing it.
Upload reports as PDF rather than Word or Excel if you want them stamped, and without a password: Noru cannot open a protected file to mark it.
Keep one gated document per report rather than a bundle. The access log records which document each viewer downloaded, which is more useful during an audit than "the bundle".
What Noru does not do
Noru does not integrate with e-signature services (DocuSign) or contract tools, and does not auto-approve requests by domain or CRM match. It does not watermark Office files or password-protected PDFs, and the watermark is not copy protection. Names in scripts the stamp's font cannot draw appear as question marks; the email address is always legible. It does not check that the company a requester typed is real; the confirmed email domain is the fact you have.
Related
Last updated on