Get certified. Stay certified. Let the agents do the work.

Yes — it is what most customers arrive for. Noru is not a certification body and does not sell the audit: you appoint your own auditor, and Noru is where the program lives before, during and after. Lawline completed its first ISO 27001 certification with Noru as the operational hub for policies, controls and evidence, and Ossus describes going from onboarding to completed certification in two weeks. How long it takes you depends on how much is already in place.

Through the mapping, not through a folder. Every control shows the evidence that satisfies it, when it was captured and what produced it, and audit-ready exports run per framework. The audits module plans internal and external audits against evidence that already exists, so preparation is a review rather than a collection exercise.

The work a person would otherwise do by hand. They map controls across the frameworks you carry, draft and map policies, gather evidence from your connected systems and link it to the controls it satisfies, flag a control the moment it drifts, and surface the next most valuable task. Each output is a reviewable draft — nothing enters your program, or reaches your auditor, without a human accepting it.

Three things you can check rather than take on trust. Reach: the agents work every area a certificate depends on — controls, evidence, policies, risk, vendors, privacy, training and audits — not a chat box over a few endpoints. Depth: the frameworks the category skips are first-class, including DORA with both ICT third-party regimes, NIS2, the EU Cyber Resilience Act, PSD2, ISO 42001 and the EU AI Act alongside ISO 27001 and SOC 2. Provenance: every evidence record carries a capture-time digest and a record of what produced it, so an auditor can check the agent's work rather than believe it.

Two bounds, not one. Over MCP every tool is bound to a domain-scoped permission — read:controls, write:evidence — and a tool with no rule is unreachable rather than permissively scoped; inside the product, Cortex resolves org.read and org.write against the role of whoever is driving, so a viewer cannot update a control through an agent any more than through the UI. And nothing an agent produces is published by the agent — policies, mappings and evidence links land as drafts a person accepts, edits or dismisses, with the change recorded against them.

Open the item and check. Every evidence record is written with a canonical SHA-256 of its content, a SHA-256 of the stored file's bytes where there is a file, and a provenance record naming what produced it, how it was collected and when — and the evidence drawer shows all of it on an Integrity row. The row reads “Sealed” rather than “Verified” until somebody presses “Check it hasn't changed”, because a digest recorded at capture proves what was captured, not that nothing has changed since; pressing it recomputes the digest and answers unchanged or changed. The digests are computed where evidence is written and are never accepted from the caller, an upload may declare the SHA-256 it expects and a mismatch is rejected before anything is stored, and items that predate integrity capture hide the row rather than claiming a verdict nobody can act on.

For a Cortex answer, the relevant program context goes to a model provider — and comes straight back. We run every model call under zero data retention terms: the provider returns the output and keeps no copy of the prompt or the response, nothing is queued for human review, and nothing is retained for training. Your data is never used to train, fine-tune or evaluate a model, ours or theirs. AI enrichment stays opt-in per organization, every suggestion is a draft until your team accepts it, and both commitments are contractual — Section 4.6 of the Terms and Sections 3.5–3.6 of the DPA.