One Operating System for Compliance

Noru connects to the systems that already hold the truth — cloud accounts, identity providers, source control, device management and collaboration tools — and reads their state on a schedule. Each signal is mapped to the controls it satisfies, so evidence accumulates as a by-product of running the business rather than as a task somebody has to remember before an audit.

It means a control has a current state rather than a last-reviewed date. Noru re-checks the underlying signal on an interval, records the result, and raises a finding when the control drifts out of conformance — so the gap surfaces when it opens instead of during audit fieldwork months later.

Most frameworks ask overlapping questions in different words. Noru maps a single control set to every framework it satisfies, so implementing access review once satisfies the corresponding requirement in SOC 2, ISO 27001, NIS2 and the rest. Adding a framework reuses the evidence you already collect instead of starting a second programme.

No. Noru sits on top of your existing stack and reads from it. There is nothing to migrate, and no parallel process for engineers to maintain alongside the systems they actually work in.

Cortex drafts — policies, control narratives, privacy records, assessment responses — grounded in the evidence already in your programme, and every output is attributable and reviewable. It does not silently decide whether a control passes or a legal basis holds. Those remain accountable human judgements, recorded with the person who made them. And it never learns from you: your data is not used to train, fine-tune or evaluate any model.

Nothing, and nothing. Customer data is never used to train, fine-tune or evaluate a model — ours or a third party's — and every AI call runs under zero data retention terms, so the model provider returns the output and retains no copy of the prompt or the response. No human review queue, no training corpus, no exceptions by plan. Both commitments sit in the Terms (Section 4.6) and the DPA (Sections 3.5–3.6), so your procurement team can read them rather than take our word for it.

Yes. Noru exposes a REST API and a Model Context Protocol server, so AI clients such as Claude, ChatGPT, Cursor and Perplexity can query your live control, evidence and risk data directly, scoped by an API key you control.

In the EU. Noru runs with EU data residency, encryption in transit and at rest, role-based access control, and a published subprocessor list, with a DPA and SLA available as part of every deployment. AI inference is the one processing activity that may leave the EEA, and it runs under zero data retention terms with EU Standard Contractual Clauses in place.