Glossary
Terms used across Noru and these docs, each linked to the page that explains it.
Terms are listed alphabetically with the meaning Noru gives them, which is sometimes narrower than the industry meaning. Follow the link for the full explanation and the screens where the term appears.
A to F
| Term | Meaning | Where |
|---|---|---|
| Activity source | Whether a change was made in the app (web), through the REST API (api), or through an MCP tool (mcp). Recorded on every authenticated call. | REST API |
| AI inferred | A status or record proposed by Cortex or derived from evidence rather than asserted by a person. Shown as "AI Inferred" on controls and risks. | Statuses |
| AI inventory | A manifest of AI systems pushed from CI with the write:ai-inventory scope; lands as privacy systems and feeds the AI register. | MCP server |
| API key | An organization-scoped bearer token with explicit scopes, created by an admin, used for REST and headless MCP. | API keys |
| Assessment (privacy) | A structured impact assessment (DPIA-style) on a processing activity, with an outcome such as proceed or consult authority. | Assessments |
| Asset | A system, device, repository, or service in the inventory, usually collected by a data source. | Assets |
| Attestation | A person confirming they completed training or read a policy, either signed in or through an emailed link. | Training and acknowledgement |
| Audit package | The controlled bundle of evidence you hand to an external auditor. | External audit |
| Auditable framework | A standard you can be assessed against (SOC 2, ISO 27001, and most of the catalog); controls go through verification. | Frameworks |
| Capability | The permission an action checks: org.read, org.write, settings.manage, or billing.checkout. Derived from role. | Roles and permissions |
| Certificate | A TLS certificate discovered for one of your domains, tracked for expiry. | Certificates |
| Connected app | A third-party OAuth grant observed in your identity provider, reviewed and mapped to a vendor. | Connected apps |
| Connector proposal | An Inbox item suggesting a new processing record based on what a connector observed. | Inbox |
| Control | A requirement-satisfying measure from an enabled framework, with a status, owner, and linked evidence. Controls are framework-derived and cannot be created by hand. | Controls |
| Control coverage | The share of a control's requirements that have valid evidence or an approved policy linked; 100 lets the coverage check set implemented. | Control status and coverage |
| Cortex | Noru's AI assistant. It answers questions for every role and, for editors and admins, can change records. | Cortex |
| Customer segment | Whether an organization has the compliance product, the privacy product, or both; decides which sidebar sections exist. | Roles and permissions |
| Data map | The privacy inventory of systems, datasets, and processing activities, materialised from fideslang manifests and connectors. | Data map |
| Data source | A connected provider (GitHub, AWS, Google Workspace, and so on) that syncs facts, evidence, assets, and identities. | Data sources |
| DPA | Data processing agreement with a vendor; tracked per vendor as a status. | Vendor detail |
| DPIA | Data protection impact assessment; in Noru, a privacy assessment. | Assessments |
| Drift | A difference between what a scan or connector observes and the approved privacy record. Raised as a drift finding in the Inbox. | Privacy scanner and drift |
| Evidence item | A file, note, link, or automatically collected record that supports one or more control requirements. | Evidence vault |
| Evidence integrity | The attestation hash chain that lets you prove an evidence item has not changed since it was collected. | Evidence lifecycle and integrity |
| External audit | An engagement with an outside auditor, tracked with its evidence package. | External audit |
| Fideslang | The open taxonomy and YAML manifest format Noru ingests to build the data map. | Data map |
| Finding (audit) | A non-conformity, observation, or opportunity raised during an internal audit. | Internal audit |
| Finding (security) | A vulnerability, misconfiguration, or posture issue, entered by hand or imported from a scanner. | Findings |
| Framework | A regulation or standard whose controls you track; 31 in the catalog. | Frameworks |
G to P
| Term | Meaning | Where |
|---|---|---|
| Inherent risk | The risk score before treatments are applied. | Risk register |
| Integration | A data-source connection with its credentials, schedule, and sync log. | Integrations |
| Internal audit | A self-run audit of selected controls that produces findings and a report. | Internal audit |
| Job | A unit of background work (a sync, an expiry sweep, an AI enrichment) that Noru runs for you. | Sync model and job scheduler |
| MCP | Model Context Protocol; how AI clients call Noru tools over https://api.noru.tech/v1/mcp. | MCP server |
| Monitor (privacy) | A website Noru scans on a schedule for cookies, trackers, consent banners, and policy links. | Monitoring |
| Notification | An in-app or email message about something that needs you; preferences live on your account page. | Notifications |
| OAuth consent | The screen where you approve an MCP client, pick the organization, and tick scopes. | MCP server |
| Organization context | The description of your company, systems, and obligations that Cortex and policy generation draw on. | Context |
| Personnel | People in the directory, whether or not they have a Noru login; the subjects of training and acknowledgements. | People directory |
| Policy | A governing document with versions, an approver, and acknowledgements; an approved policy counts toward linked controls. | Policies |
| Policy acknowledgement | A person's confirmation that they read a specific policy version. | Policy versioning and acknowledgements |
| Privacy Inbox | The queue of drift, proposals, record intake, and AI drafts awaiting a decision. | Inbox |
| Processing activity | One purpose-bound use of personal data; the unit of the RoPA. | Records of processing |
Q to Z
| Term | Meaning | Where |
|---|---|---|
| Questionnaire | A template sent to a vendor; answers come back as an assignment you review. | Questionnaires |
| Rate limit | 500 authenticated API requests per 10 minutes per credential. | REST API |
| Regulatory framework | A law rather than a standard (gdpr, ccpa, eu_ai_act); tracked without a verification phase. | Frameworks |
| Remembered consent | An OAuth approval saved per client, user, and organization so the consent screen is skipped next time; re-narrowed to your current role on reuse. | MCP server |
| Requirement | One clause of a framework that a control must satisfy; evidence links at requirement level count toward coverage. | Control status and coverage |
| Residual risk | The risk score after completed treatments. | Risk scoring and reports |
| Risk | An entry in the risk register with likelihood, impact, owner, treatments, and links to controls and findings. | Risk register |
| Role | Admin, editor, or viewer; the single permission level a member holds in an organization. | Roles and permissions |
| RoPA | Records of processing activities (GDPR Article 30); generated from approved processing activities and exportable as CSV. | Records of processing |
| Scope | A named permission on an API key or OAuth token, such as read:controls or write:risks. | API keys |
| Security measure | A technical or organisational measure attached to processing activities in the data map. | Records of processing |
| Sync | One run of a data source's collection, recorded in the sync log as success, partial, or error. | Sync model |
| Task | A piece of work derived from a control, evidence item, policy, risk, or finding; it has no status of its own. | Tasks |
| Training campaign | A scheduled run of a training plan that creates assignments for people. | Training and acknowledgement |
| Treatment | An action on a risk (avoid, transfer, mitigate, accept) with its own status. | Create and edit risks |
| Trust page | The public page showing your certifications, policies, and controls, on a Noru address or your own domain. | Public trust page |
| Vendor | A third party in the register with an assessment status, contacts, evidence, and DPA status. | Vendor register |
Last updated on