Where can customer data be hosted?
Customers can contract for region-specific hosting. The exact region remains contract-specific.
FAQ
Review answers without the implementation blueprint.
Concise answers for security, legal, procurement, IT, and executive reviewers.
source-backedpublic overview
Who operates customer environments?
Northra operates customer environments with EU-resident personnel only, including non-EU hosted environments.
How is tenant data isolated?
Customer data is isolated by design, with public copy avoiding deployable architecture detail.
Is data encrypted?
Public trust content states encryption in transit and at rest as part of the security overview.
Does AI replace domain experts?
No. AI augments ontology, explanation, rationale drafting, and workflow guidance. Humans retain decision authority.
Does Northra write back to source systems?
The V0 posture is read-only and does not perform source-system write-back.
Can product analytics include raw sensitive values?
No. Product analytics must stay product-safe and exclude sensitive source values or customer document content.
How are subprocessors presented?
The trust center lists processor categories and marks deployment-dependent vendors as contract or deployment dependent.
What happens at pilot exit?
Pilot exit supports customer-agreed data return and destruction by data class.
How are incidents handled?
Public content covers severity handling, customer notification path, data-exposure triage, rollback, and log preservation at a high level.
What is the backup and restore posture?
Public content covers database backups, object versioning where appropriate, restore testing before production pilot, and exportable critical artifacts.
What is Northra's SOC 2 status?
Northra does not make a SOC 2 attestation claim unless a future approved source explicitly supports it.
Can deeper security artifacts be reviewed?
Public pages can route reviewers to contact Northra for NDA-gated or customer-specific review materials.
Enterprise review
Need the private evidence pack?
Public pages provide the overview. Customer-specific security exhibits, DPAs, and implementation details stay behind the appropriate review path.