Skip to main content
Compliance is a mix of platform certifications, workspace configuration, and per-Flow controls. This page covers all three.

​
Platform certifications

  • SOC 2 Type II — audited annually. Report available under NDA on request.
  • ISO 27001 — in progress.
  • HIPAA BAA — available on Enterprise plans. Contact sales.
  • GDPR — full compliance for EU workspaces. Nora acts as processor; you’re the controller.
  • CCPA — supported via user data export and erasure endpoints.
Report requests: contact@conscience.technology.

​
Data locality

Every workspace is pinned to a region at creation:
  • Asia-Pacific (Seoul) — default for Korean sign-ups.
  • North America (Oregon) — default for US sign-ups.
  • Europe (Frankfurt) — GDPR-region default.
Data stays in the region — indexes, traces, memory, backups. Cross-region access is possible but adds latency. Enterprise workspaces can be pinned to specific regions during setup, including additional zones for regulated workloads.

​
Compliance mode

Settings → Data → Compliance mode. Per-Flow toggle. Tightens platform behavior for regulated workloads. Effects:
  • Every action requires a reason (release notes, approval decisions, secret rotations — no anonymous edits).
  • Audit retention forced to the compliance minimum for your regulatory regime.
  • Destructive actions require multi-sign (delete flow, delete document, purge memory).
  • Data export requires explicit approval workflow (a reviewer + a reason).
  • Payload retention capped at a strict maximum.
Compliance mode is a one-way transition per Flow. Turning off requires an Owner + written justification (audit-logged).

​
GDPR — right to be forgotten

For a user data erasure request: Settings → Data → Erasure requests → New:
  1. Enter the user identifier (email or scope key).
  2. Preview what would be deleted.
  3. Confirm — erasure runs and is audit-logged.
Erasure is permanent. Prefer supersede for anything you might want back. The nora feedback --external-user field ties user-attributed feedback to your user IDs, making erasure clean.

​
GDPR — right to data portability

Full export of a specific user’s data: Settings → Data → User exports → New. Produces a signed ZIP with:
  • Traces where scope matches the user.
  • Memory items scoped to the user.
  • Feedback attributed to the user.
  • Approvals decided by the user.
Standard format so the export can be handed to another platform.

​
HIPAA (BAA)

Enterprise plans qualify for a Business Associate Agreement (BAA):
  • All data encrypted at rest with per-workspace keys.
  • Audit forwarding to your SIEM (mandatory).
  • Compliance mode required for Flows handling PHI.
  • Provider selection restricted to HIPAA-compatible providers only.
  • Region pinning to a HIPAA-compliant region.
Contact sales for the BAA process. Not enabled by default even on Enterprise plans — requires explicit setup.

​
Data processing agreement (DPA)

Nora publishes a standard DPA covering the processor-controller relationship. Available under Settings → Data → DPA. Signed automatically for paid plans; free plans use a version-1 DPA linked in the sign-up flow. Amendments (customer-specific terms) available on Enterprise plans.

​
Subprocessors

The list of subprocessors (hosting, storage, OAuth providers, model providers on managed tier) is at: Nora notifies workspace Owners before adding new subprocessors, with an opt-out window per DPA terms.

​
Encryption

  • In transit — TLS 1.3 everywhere.
  • At rest — AES-256 with per-workspace keys.
  • Key management — customer-managed keys (BYOK) available on Enterprise plans.
BYOK setup: Settings → Data → Encryption → BYOK. Requires an active AWS KMS / GCP KMS / Azure Key Vault credential.

​
Backup

  • Continuous — every write is replicated.
  • Snapshots — daily point-in-time snapshots retained per your retention policy.
  • Restore — request via support. Requires Owner authorization.
Backups follow the workspace’s region locality.

​
Access reviews

Periodic access reviews are a common compliance requirement:
  • Settings → Data → Access reviews exports a snapshot of every member, their role, their tokens, and their last activity.
  • Schedule quarterly exports and route to your GRC tool.

​
Certifications proof

For customer procurement questions requiring proof of SOC 2 / ISO / HIPAA compliance: