> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> SOC 2, HIPAA, GDPR, and Compliance mode — how Nora meets regulatory requirements.

Compliance is a mix of platform certifications, workspace configuration, and per-Flow controls. This page covers all three.

## Platform certifications

* **SOC 2 Type II** — audited annually. Report available under NDA on request.
* **ISO 27001** — in progress.
* **HIPAA BAA** — available on Enterprise plans. Contact sales.
* **GDPR** — full compliance for EU workspaces. Nora acts as processor; you're the controller.
* **CCPA** — supported via user data export and erasure endpoints.

Report requests: [contact@conscience.technology](mailto:contact@conscience.technology).

## Data locality

Every workspace is pinned to a region at creation:

* **Asia-Pacific (Seoul)** — default for Korean sign-ups.
* **North America (Oregon)** — default for US sign-ups.
* **Europe (Frankfurt)** — GDPR-region default.

Data stays in the region — indexes, traces, memory, backups. Cross-region access is possible but adds latency.

Enterprise workspaces can be pinned to specific regions during setup, including additional zones for regulated workloads.

## Compliance mode

**Settings → Data → Compliance mode**. Per-Flow toggle. Tightens platform behavior for regulated workloads.

Effects:

* Every action requires a reason (release notes, approval decisions, secret rotations — no anonymous edits).
* Audit retention forced to the compliance minimum for your regulatory regime.
* Destructive actions require multi-sign (delete flow, delete document, purge memory).
* Data export requires explicit approval workflow (a reviewer + a reason).
* Payload retention capped at a strict maximum.

Compliance mode is a **one-way transition per Flow**. Turning off requires an Owner + written justification (audit-logged).

## GDPR — right to be forgotten

For a user data erasure request:

**Settings → Data → Erasure requests → New**:

1. Enter the user identifier (email or scope key).
2. Preview what would be deleted.
3. Confirm — erasure runs and is audit-logged.

Erasure is permanent. Prefer supersede for anything you might want back.

The [`nora feedback`](/cli/feedback) `--external-user` field ties user-attributed feedback to your user IDs, making erasure clean.

## GDPR — right to data portability

Full export of a specific user's data:

**Settings → Data → User exports → New**. Produces a signed ZIP with:

* Traces where scope matches the user.
* Memory items scoped to the user.
* Feedback attributed to the user.
* Approvals decided by the user.

Standard format so the export can be handed to another platform.

## HIPAA (BAA)

Enterprise plans qualify for a Business Associate Agreement (BAA):

* All data encrypted at rest with per-workspace keys.
* Audit forwarding to your SIEM (mandatory).
* Compliance mode required for Flows handling PHI.
* Provider selection restricted to HIPAA-compatible providers only.
* Region pinning to a HIPAA-compliant region.

Contact sales for the BAA process. Not enabled by default even on Enterprise plans — requires explicit setup.

## Data processing agreement (DPA)

Nora publishes a standard DPA covering the processor-controller relationship. Available under Settings → Data → DPA. Signed automatically for paid plans; free plans use a version-1 DPA linked in the sign-up flow.

Amendments (customer-specific terms) available on Enterprise plans.

## Subprocessors

The list of subprocessors (hosting, storage, OAuth providers, model providers on managed tier) is at:

* **Settings → Data → Subprocessors**.
* **Public list**: [https://nora.my/subprocessors](https://nora.my/subprocessors)

Nora notifies workspace Owners before adding new subprocessors, with an opt-out window per DPA terms.

## Encryption

* **In transit** — TLS 1.3 everywhere.
* **At rest** — AES-256 with per-workspace keys.
* **Key management** — customer-managed keys (BYOK) available on Enterprise plans.

BYOK setup: **Settings → Data → Encryption → BYOK**. Requires an active AWS KMS / GCP KMS / Azure Key Vault credential.

## Backup

* **Continuous** — every write is replicated.
* **Snapshots** — daily point-in-time snapshots retained per your retention policy.
* **Restore** — request via support. Requires Owner authorization.

Backups follow the workspace's region locality.

## Access reviews

Periodic access reviews are a common compliance requirement:

* **Settings → Data → Access reviews** exports a snapshot of every member, their role, their tokens, and their last activity.
* Schedule quarterly exports and route to your GRC tool.

## Certifications proof

For customer procurement questions requiring proof of SOC 2 / ISO / HIPAA compliance:

* Contact [contact@conscience.technology](mailto:contact@conscience.technology).
* We'll share the current report under NDA.
* Trust center: [https://nora.my/trust](https://nora.my/trust) (public overview).

## Related

* [Audit](/settings/security/audit) — audit trail (compliance depends on this).
* [Retention](/settings/data/retention) — retention configuration.
* [Data export](/settings/data/export) — portability workflow.
* [Access & policies](/settings/workspace/access) — workspace-level policy enforcement.