Noru

Privacy · Data protection at scale

Privacy records that maintain themselves.

A living record of processing that updates as your systems change — instead of a spreadsheet you rebuild before every audit. Noru derives your records of processing from the systems that actually handle personal data: annotated in code, pushed from CI, enriched by AI, governed by your privacy team.

Request a demoExplore the platform

The way this usually goes

Questionnaires capture what people remember, not what systems do — and they're stale before the quarter ends.

Legal bases, retention and transfer safeguards live in a spreadsheet nobody trusts when a regulator or customer asks.

Every new feature ships processing changes that privacy hears about months later, if at all.

How it works, end to end

From a line of code to a defensible record

Privacy records derive from the systems that actually handle personal data — annotated in code, pushed from CI, enriched by AI, governed by your team.

01 · Annotate

Tagged in code

Engineers label data categories, uses and subjects in a standardized privacy taxonomy that lives next to the code processing them.

02 · Push

Synced from CI

On every push, a CI step sends the manifest to Noru, stamped with the commit it was generated from.

03 · Enrich

Materialized & enriched

Systems, datasets and processing activities appear in Noru. AI drafts legal bases, retention and transfer safeguards.

04 · Govern

Records stay live

DPIAs auto-trigger on new risk. Your Article 30 register and data map update themselves — ready for any regulator.

Derived from code, not memory

One manifest, next to the code it describes

Engineering describes each field once — data categories, uses and subjects — in a standardized privacy taxonomy that lives next to the code. CI pushes it to Noru, which materializes systems, datasets and processing activities, with field-level granularity and a full change history on every commit.

  • Standardized privacy taxonomy: 40+ data categories out of the box
  • Immutable version history with change detection on every push
  • Each record deep-links back to the commit that introduced it

Engineering describes each field once — data categories, uses and subjects — next to the code that processes it, in a standardized, open privacy taxonomy with 40+ data categories out of the box.

yaml
dataset:  - fides_key: payments_postgres    name: Payments database    collections:      - name: customers        fields:          - name: email            data_categories: [user.contact.email]          - name: card_number            data_categories: [user.financial.account_number]          - name: national_id            description: KYC verification — special category            data_categories: [user.government_id]system:  - fides_key: payments_api    name: Payments API    system_type: Service    privacy_declarations:      - name: Process customer payments        data_use: essential.service.payment        data_categories: [user.financial.account_number]        data_subjects: [customer]      - name: Marketing analytics        data_use: marketing.advertising        data_categories: [user.contact.email]        data_subjects: [customer, prospect]

A shared language for data

Describe data once, in an open standard

To automate privacy across many regimes, every system has to describe its data the same way. Noru classifies each field against a standardized, open privacy taxonomy — what the data is, why it's processed and whose it is — so one classification travels across tools, teams and jurisdictions instead of being re-described for each.

Privacy/Activity
Live

Risks surface before they ship

The right assessment fires on its own

When a manifest introduces special-category data or a cross-border transfer, Noru opens a DPIA automatically — before the feature ships, not after the regulator asks. AI drafts the legal basis and retention; your team accepts, edits or dismisses.

  • Auto-triggered GDPR DPIAs and US state assessments
  • Transfer detection with safeguard tracking — SCCs, adequacy, BCRs
  • Every AI suggestion is a draft until a human approves it

One map, your whole Article 30

A data map your DPO can navigate

Systems, datasets and processing activities render as an interactive map — hover any node to trace its data flow, click to inspect legal basis and retention. Your Article 30 register exports straight from it, and it doubles as a US state-law inventory.

PrivacyData map

Systems and the datasets they store, plus each processing activity: the personal data it uses, whose data it is, and why.

Systems
Datasets
Processing activities
Purposes
Data categories
Data subjects
Customer onboarding & KYCProcessing activity
Legal basisLegal obligationRetention5 years

One map, every jurisdiction

The laws that apply, decided by what you actually do

Which obligations apply depends on what you do with data, not on what you guessed at audit time. Noru reads the signals in your activities and maps them to the regimes they trigger — so the same underlying map serves every applicable jurisdiction at once.

Signals it watches

  • Special-category data
  • Cross-border transfers
  • Sale or sharing
  • Targeted advertising
  • Profiling
  • Consent & tracking

European Union

GDPR

Article 30 records and DPIAs, derived and kept current.

California

CCPA / CPRA

Sale and sharing signals, with opt-out obligations.

Virginia

VCDPA

Data protection assessments on triggering activity.

Colorado

CPA

Profiling and targeted-advertising obligations.

As new laws come into force, the same activity signals map to new obligations — without sending another questionnaire to your engineers.

Consent · the banner is not the control

Prove you honor the answer, not just that you asked

A consent banner records that you asked the question. It says nothing about whether your site stops tracking when a visitor clicks Reject — and that gap is where the fines live. Consent is a runtime behavior that drifts with every new pixel, vendor script and deploy, so Noru treats it as something to monitor, not configure once.

Noru's privacy monitor loads your properties the way a real visitor would, exercises the consent flow, and records what the browser actually does — scored against a jurisdiction-aware rubric, because GDPR/ePrivacy opt-in is a different obligation from US opt-out.

  • Behavioral scans, not questionnaires — cookies, trackers, CMP, TCF strings and GPC observed on the live page
  • Per-jurisdiction scoring, with a banner screenshot as evidence you can hand an auditor
  • Findings surface as risks wired into the rest of your privacy program — continuous by default

Who it's for

One system, every stakeholder

Privacy & DPO

Own an Article 30 register that is always current, with field-level lineage you can defend to any regulator.

Engineering

Annotate once in code and CI keeps the register in sync — no quarterly questionnaires.

Legal & compliance

Legal bases, retention and transfers reasoned per activity — drafted by AI, approved by you.

Leadership

Privacy posture visible next to risk, ready for regulators and enterprise customers.

What's included

Platform modules working together

This solution runs on the same system of record as everything else — add modules later without re-platforming.

Privacy Automation

Map every data flow, continuously

Data maps, records of processing and impact assessments derived from the systems that hold the data and enriched by AI.

Data Sources

Connect once, sync forever

20+ integrations — AWS, GCP, Azure, GitHub, Slack, Entra ID and more — feeding evidence in real time.

Risk Register

Know your risk before anyone asks

A live register linked to security findings, controls and treatments — not a yearly workshop artifact.

Policies

Keep every policy acknowledged

AI-assisted drafting, versioning, approvals and acknowledgements, mapped to the controls they satisfy.

Works with

  • GitHub
  • GitLab
  • AWS
  • GCP
  • Databricks
  • more

Request a demo

See it on your own data.

A walkthrough tailored to this use case, with your questions answered by practitioners.

  • 45 minutes, tailored to the frameworks and use cases you care about
  • Answers from practitioners, not a sales script
  • Leave with a concrete rollout plan — or a clear no-fit

We respond within one business day. No mailing lists, no spam.

FAQ

Frequently asked questions

How do processing activities get into Noru?

Engineering teams describe data categories, uses and subjects once, in a standardized privacy-taxonomy YAML manifest that lives next to the code. A CI step pushes the manifest to Noru on every change, and Noru materializes systems, datasets and processing activities from it — with full version history.

We already have a records-of-processing spreadsheet. Can we import it?

Yes. You can create and edit processing activities manually, so existing records can be migrated and then progressively backed by manifests as teams adopt the annotation workflow.

What does the AI actually do — and can we trust it?

The AI drafts legal bases, retention reasoning and applicable safeguards from each activity's code context and system description. Every suggestion is marked as a draft until a human accepts or dismisses it. Nothing enters your official register without review.

Which privacy laws does this cover?

Describe your data once and Noru reads the signals in your activities — special-category data, cross-border transfers, sale or sharing, targeted advertising, profiling — to map them to the regimes they trigger. Today that includes the EU GDPR plus US state laws such as California (CCPA/CPRA), Virginia (VCDPA) and Colorado (CPA), with assessments that satisfy GDPR DPIAs and US state data protection assessments alike. As new laws come into force, the same signals map to new obligations — no fresh questionnaire to engineering.

Does this check that we actually honor consent on our sites?

Yes. A consent banner proves you asked the question; it says nothing about whether your site stops tracking when someone clicks Reject. Noru's privacy monitor loads your properties like a real visitor, exercises the consent flow, and records what the browser actually does — cookies set, trackers fired, the CMP detected, the IAB TCF string parsed, and whether Global Privacy Control is honored. It scores that behavior against a jurisdiction-aware rubric (GDPR/ePrivacy opt-in versus US opt-out), captures a screenshot of the banner as it was shown, and surfaces any gap as a finding you can track — so consent is a monitored, evidenced control rather than a one-time CMP setup.

Related solutions

AI governance · For AI-native companies

AI Governance

Learn more

Vendors · TPRM

Third-Party Risk Management

Learn more