Trust
Security and data handling.
Norma reads your firm's book of record and never trains on your data. Nothing client-facing leaves without a person. Everything else on this page follows from that posture.
Scope
What Norma protects.
Norma is built for the kinds of information architecture and design firms already keep in spreadsheets, inboxes, and disconnected tools. These are the categories the product is designed to treat as sensitive within a firm workspace.
- Contracts and scopes
- Financial reports
- AR/AP and cash flow data
- Pipeline and backlog data
- Project budgets and staffing context
- Valuation inputs and assumptions
- Employee records: roster, compensation and its history, benefits enrollment
- Workspace conversations and uploaded files
Perimeter
What Norma touches, and what it never does.
Norma reads
- QuickBooks Online, read-only, through your own OAuth connection
- Timesheets and staffing data, synced or uploaded
- Contracts, as uploaded documents
- Accounts receivable, invoices, and the general ledger
- Payroll reports your firm schedules and sends: roster, compensation, benefits enrollment
The gated writes
- One invoice push to QuickBooks: composed by Norma, confirmed by a person, never automatic
- Gmail drafts, created in your own Drafts folder for a person to review and send
- One optional internal reminder, off by default: only to a colleague at your own firm, only after a person approves it
Never
- No payroll sign-in, and no payroll actions
- No bank credentials, ever
- No movement of funds
- No training on firm data
On payroll specifically: Norma never signs in to your payroll system and holds no payroll credentials, so it can never take a payroll action. It reads only the reports your firm chooses to schedule and send, and switching that schedule off stops the flow.
Boundaries
Workspace separation.
Norma is designed so firm data is processed in scoped workspace context and is not shared across customer workspaces. API requests that touch firm data are gated by workspace membership; database access is scoped to the active workspace, with isolation enforced in code and covered by a dedicated automated test suite.
Within a workspace, role-based access separates admins from members. Admins can invite users, adjust permissions, and remove data. Members use the product without changing workspace structure. The roles are intentionally simple.
Access
Authentication and access.
Sign-in is email and password. Passwords are hashed with bcrypt and are never stored in plaintext or in a recoverable form.
Login attempts are rate-limited. After repeated failures from a given IP-and-email pair within a short window, that pairing is temporarily locked at the application layer to reduce credential-stuffing risk.
Sessions use JSON Web Tokens with a limited lifetime. Two-factor authentication and single sign-on are on the security roadmap below.
Infrastructure
Storage and transport.
-
Where data is stored
-
Each customer operates in its own workspace. Uploaded files, metrics, conversation history, and analysis outputs are scoped at the database layer. Reads and writes go through workspace authorization checks.
The production database is PostgreSQL, hosted on Railway, with encryption at rest provided by the hosting environment. Uploaded files are stored within that same environment (database BLOB storage and filesystem as appropriate).
Payroll reports your firm sends are read from your own mailbox. Norma does not keep the file: it records the employee data the report contains in that same database, and no separate service holds any of it.
Norma does not currently offer a separate customer-managed encryption layer on top of the platform default. Firms with stricter requirements should ask us directly.
-
Data in transit
-
Connections to Norma (marketing site, application, and API) use HTTPS with TLS at the edge. Norma does not operate a plain-HTTP version of the product for firm data. Connections from Norma to upstream services (such as AI APIs and email) also use HTTPS.
Traffic between Norma's own services runs within the hosting provider's environment; cross-region and external paths are encrypted in transit.
Models
AI provider usage.
Norma's reasoning layer calls external model providers (including Anthropic and OpenAI) through standard commercial API integrations. Only the inputs required for a given task are sent: a specific question, relevant metrics, contract excerpts, or summaries. Not full database dumps or every stored file on each request.
Norma uses its AI providers under commercial API terms, under which your firm's inputs and outputs are not used to train the providers' models. Providers may briefly retain API data for abuse monitoring and operational integrity under their published terms; firms with specific data-handling requirements can review each provider's current documentation directly.
Norma uses AI to reason over your firm's workspace data to produce answers for users in that workspace. It does not mix one customer's content into another's workspace.
Lifecycle
Data deletion and control.
When a user deletes an uploaded file, file content is removed from storage. A soft-deleted database record may remain so audit trails stay coherent for work that referenced the file (for example analyses or memos). The underlying file content is gone.
Conversations and chat history are hard-deleted on user request, without retaining conversation content afterward.
If a firm ends its relationship with Norma, the workspace is decommissioned and underlying data is removed within thirty days. Firms should export anything they need to keep before closure.
Posture
Security roadmap.
The current posture is designed for small and mid-sized firms that need practical safeguards, clear workspace boundaries, and transparent handling of firm information. The controls below are on the security roadmap as the product matures into engagements that require them.
On the security roadmap
- SOC 2 attestation
- ISO 27001 certification
- Independent third-party security audit
- Two-factor authentication
- Single sign-on
If you need controls that are not shipped yet, contact us before a broad rollout. We will be direct about what is in place and what is on the roadmap.
Vulnerability reports in good faith: security@norma-adi.com
The paper
The documents behind this page.
Everything above is written down formally, versioned and dated.
- Data Processing Agreement Roles, processing scope, security measures, breach notice, and deletion on termination. The public reference copy.
- AI use statement What models are used and for what, the training prohibition, and the rule that engines compute and models narrate.
- Subprocessor list Every service that processes data on Norma’s behalf, and the services your firm connects on its own credentials.
- Privacy Policy What is collected, how it is used, retention, and your rights.
- Terms of Service The agreement governing use of the Service.
Contact
Questions about data handling?
If your firm needs to understand how Norma handles uploaded files, workspace data, or AI usage before getting started, contact us.
hello@norma-adi.com