Noru

Privacy · Data protection at scale

Privacy records that maintain themselves.

A living record of processing that updates as your systems change — instead of a spreadsheet you rebuild before every audit. Noru derives your records of processing from the systems that actually handle personal data: annotated in code, pushed from CI, enriched by AI, governed by your privacy team.

Book a demoExplore the platform

The way this usually goes

Questionnaires capture what people remember, not what systems do — and they're stale before the quarter ends.

Legal bases, retention and transfer safeguards live in a spreadsheet nobody trusts when a regulator or customer asks.

Every new feature ships processing changes that privacy hears about months later, if at all.

How it works, end to end

From a line of code to a defensible record

Privacy records derive from the systems that actually handle personal data — annotated in code, pushed from CI, enriched by AI, governed by your team.

01 · Annotate

Tagged in code

Engineers label data categories, uses and subjects in a standardized privacy taxonomy that lives next to the code processing them.

02 · Push

Synced from CI

On every push, a CI step sends the manifest to Noru, stamped with the commit it was generated from.

03 · Enrich

Materialized & enriched

Systems, datasets and processing activities appear in Noru. AI drafts legal bases, retention and transfer safeguards — under zero data retention, and never used to train a model.

04 · Govern

Records stay live

DPIAs auto-trigger on new risk. Your Article 30 register and data map update themselves — ready for any regulator.

Read from the schema, not from memory

One manifest, next to the code it describes

An open-source piece reads the schemas your repository actually defines — SQL migrations, Drizzle, Prisma, Django, protobuf, GraphQL — and classifies the personal data in them against a standardized privacy taxonomy. What it can prove it cites, file and line; what it cannot, a named person decides and signs for, in a manifest committed next to the schema and reviewed like any other change. One push lands it in Noru, which materializes systems, datasets and processing activities with a full version history on every commit.

  • Structure is derived, meaning is judged — an unresolved classification blocks the push
  • Every collection is signed by an owner, with an expiry, pinned to the table's structure
  • CI fails on drift, on an expired signature, and on data the privacy baseline never permitted
Browse the pieces on GitHub

What the scan writes and a person signs: every field cites the schema line it was read from, every collection carries a structure digest and a named owner with a date and an expiry, and non-personal columns are kept as a compact list so nothing leaves the audit trail.

version: 0.1.0piece: privacy-datamapsource:  slug: acme/payments  commit_sha: 4f3c1a9e77b2d5c8a10e6b4f2d9c3a71e5b80d64  branch: main  generated_by: privacy-datamap@0.9.0dataset:  - fides_key: payments_postgres    name: Payments database    collections:      - name: customers        refs: ["db/schema/customers.ts:12"]        structure_digest: 9c2f0a71d33e4b8fa10e6b4f2d9c3a71e5b80d644abfeae8e1bec7459d35fab5        interpretation:          owner: Maja Lindqvist          decided_at: "2026-08-20"          expires_at: "2027-02-20"          rationale: >-            Walked the table with the payments team. national_id is            KYC only and never leaves the EEA.          refs: ["db/schema/customers.ts:12"]        non_personal_fields: [id, created_at]        fields:          - name: email            data_categories: [user.contact.email]            refs: ["db/schema/customers.ts:14"]          - name: card_number            data_categories: [user.financial.account_number]            refs: ["db/schema/customers.ts:19"]          - name: national_id            data_categories: [user.government_id]            refs: ["db/schema/customers.ts:23"]system:  - fides_key: payments_api    name: Payments API    system_type: Service    dataset_references: [payments_postgres]    privacy_declarations:      - name: Process customer payments        data_use: essential.service.payment        data_categories: [user.financial.account_number]        data_subjects: [customer]        refs: ["src/payments/charge.ts:8"]        interpretation:          owner: Maja Lindqvist          decided_at: "2026-08-20"          expires_at: "2027-02-20"          rationale: Charging is the only thing this service does with the card.      - name: Marketing analytics        data_use: marketing.advertising        data_categories: [user.contact.email]        data_subjects: [customer, prospect]        refs: ["src/marketing/sync.ts:31"]        interpretation:          owner: Maja Lindqvist          decided_at: "2026-08-20"          expires_at: "2027-02-20"          rationale: Email is shared with the US ad platform under SCCs.

A shared language for data

Describe data once, in an open standard

To automate privacy across many regimes, every system has to describe its data the same way. Noru classifies each field against a standardized, open privacy taxonomy — what the data is, why it's processed and whose it is — so one classification travels across tools, teams and jurisdictions instead of being re-described for each.

Privacy/Assessments
3 need review

Risks surface before they ship

The right assessment fires on its own

When a manifest introduces special-category data or a cross-border transfer, Noru opens a DPIA automatically — before the feature ships, not after the regulator asks. AI drafts the legal basis and retention; your team accepts, edits or dismisses.

  • Auto-triggered GDPR DPIAs and US state assessments
  • Transfer detection with safeguard tracking — SCCs, adequacy, BCRs
  • Every AI suggestion is a draft until a human approves it

One map, your whole Article 30

A data map your DPO can navigate

Systems, datasets and processing activities render as an interactive map — hover any node to trace its data flow, click to inspect legal basis and retention. Your Article 30 register exports straight from it, and it doubles as a US state-law inventory.

PrivacyData map
Systems
Datasets
Processing activities
Purposes
Data categories
Data subjects
Customer onboarding & KYCProcessing activityLegal basisLegal obligationRetention5 years

One map, every jurisdiction

The laws that apply, decided by what you actually do

Which obligations apply depends on what you do with data, not on what you guessed at audit time. Noru reads the signals in your activities and maps them to the regimes they trigger — so the same underlying map serves every applicable jurisdiction at once.

Signals it watches

  • Special-category data
  • Cross-border transfers
  • Sale or sharing
  • Targeted advertising
  • Profiling
  • Consent & tracking

European Union

GDPR

Article 30 records and DPIAs, derived and kept current.

California

CCPA / CPRA

Sale and sharing signals, with opt-out obligations.

Virginia

VCDPA

Data protection assessments on triggering activity.

Colorado

CPA

Profiling and targeted-advertising obligations.

As new laws come into force, the same activity signals map to new obligations — without sending another questionnaire to your engineers.

Consent · the banner is not the control

Prove you honor the answer, not just that you asked

A consent banner records that you asked the question. It says nothing about whether your site stops tracking when a visitor clicks Reject — and that gap is where the fines live. Consent is a runtime behavior that drifts with every new pixel, vendor script and deploy, so Noru treats it as something to monitor, not configure once.Noru's privacy monitor loads your properties the way a real visitor would, exercises the consent flow, and records what the browser actually does. Selected regimes gate separate automated checks, while the overall score remains a global technical-risk signal rather than a legal verdict.

  • Behavioral scans, not questionnaires — cookies, trackers, CMP, TCF strings and GPC observed on the live page
  • Selected jurisdiction checks, with a timestamped banner screenshot for reviewer evidence
  • Scheduled evidence snapshots surface bounded risks for investigation and remediation
Consent/shop.acme.com

Who it's for

One system, every stakeholder

Privacy & DPO

Own an Article 30 register that is always current, with field-level lineage you can defend to any regulator.

Engineering

Annotate once in code and CI keeps the register in sync — no quarterly questionnaires.

Legal & compliance

Legal bases, retention and transfers reasoned per activity — drafted by AI, approved by you.

Leadership

Privacy posture visible next to risk, ready for regulators and enterprise customers.

What's included

Platform modules working together

This solution runs on the same system of record as everything else — add modules later without re-platforming.

Privacy Automation

Map every data flow, continuously

Data maps, records of processing and impact assessments derived from the systems that hold the data and enriched by AI.

Data Sources

Connect once, sync forever

20+ integrations — AWS, GCP, Azure, GitHub, Slack, Entra ID and more — feeding evidence in real time.

Risk Register

Know your risk before anyone asks

A live register linked to security findings, controls and treatments — not a yearly workshop artifact.

Policies

Keep every policy acknowledged

AI-assisted drafting, versioning, approvals and acknowledgements, mapped to the controls they satisfy.

Works with

  • GitHub
  • GitLab
  • AWS
  • GCP
  • Databricks
  • more

Book a demo

See it on your own data.

A walkthrough tailored to this use case, with your questions answered by practitioners.

  • 45 minutes, tailored to the frameworks and use cases you care about
  • Answers from practitioners, not a sales script
  • Leave with a concrete rollout plan — or a clear no-fit

We respond within one business day. No mailing lists, no spam.

FAQ

Frequently asked questions

The questions privacy and engineering teams ask before they wire a scan into CI.

Talk to us

How do processing activities get into Noru?

Engineering teams describe data categories, uses and subjects once, in a standardized privacy-taxonomy YAML manifest that lives next to the code. A CI step pushes the manifest to Noru on every change, and Noru materializes systems, datasets and processing activities from it — with full version history.

We already have a records-of-processing spreadsheet. Can we import it?

Yes. You can create and edit processing activities manually, so existing records can be migrated and then progressively backed by manifests as teams adopt the annotation workflow.

What does the AI actually do — and can we trust it?

The AI drafts legal bases, retention reasoning and applicable safeguards from each activity's code context and system description. Every suggestion is marked as a draft until a human accepts or dismisses it, so nothing enters your official register without review. On the data side: your processing records are never used to train, fine-tune or evaluate a model, and every model call runs under zero data retention terms — which matters when the material being drafted from is your own privacy documentation.

Which privacy laws does this cover?

Describe your data once and Noru reads the signals in your activities — special-category data, cross-border transfers, sale or sharing, targeted advertising, profiling — to map them to the regimes they trigger. Today that includes the EU GDPR plus US state laws such as California (CCPA/CPRA), Virginia (VCDPA) and Colorado (CPA), with assessments that satisfy GDPR DPIAs and US state data protection assessments alike. As new laws come into force, the same signals map to new obligations — no fresh questionnaire to engineering.

Does this check that we actually honor consent on our sites?

It checks externally observable behavior, with explicit limits. Noru loads the tested page, attempts visible consent actions, and records cookies, classified network endpoints, CMP and IAB TCF signals, transport posture, and a GPC-phase network comparison. Selected legal regimes gate the automated checks, but the score remains a global technical-risk score and the scan cannot prove legal applicability, processing purpose, recipient contracts, or that GPC was legally honored. Results and banner evidence help a reviewer investigate and verify the control.

Related solutions

AI governance · EU AI Act and ISO 42001

AI Governance

Learn more

Vendors · TPRM

Third-Party Risk Management

Learn more