Trust centre
What protects your material today, what we are still working towards, and how to get the documents your own review needs.
- Company
- Nordform Group Oy, Espoo, Finland
- Controls in force
- 11, each tied to the code that enforces it
- Certifications
- ISO/IEC 27001 and SOC 2 in progress, none held yet
- Security contact
- security@nordformgroup.com
Compliance
We are building our information security management system to ISO/IEC 27001 and preparing for a SOC 2 examination covering security, availability and confidentiality. We hold neither yet. Ask for our current controls, policies and progress at any time.
- ISO/IEC 27001Information security managementIn progress
- SOC 2Security, availability, confidentialityIn progress
Controls
Each control below is enforced by the product itself. Open a category to read what it does.
Data protection2 in force
- Files stored in the EU
Every upload and every generated file sits in private storage in Cloudflare’s EU jurisdiction.
- Confidential projects
Mark a project confidential and only the people named on it can open it. No model reads it, and it never feeds company learnings.
Access control3 in force
- Sessions and tokens stored as hashes
Session cookies are host-only, Secure and HttpOnly. Sessions, API tokens and sign-in links are kept only as hashes.
- OAuth 2.1 with PKCE for connected tools
A connected assistant signs in with OAuth 2.1, and an authorisation request without an S256 code challenge is refused.
- Scoped, rate-limited API tokens
Each token carries its own permissions and its own request limit. A token that may only read is refused every change.
AI and models3 in force
- Your designs train nothing
Nordform has no training or fine-tuning path. A model proposes typed data, and our own deterministic code checks and builds it.
- Claude models your administrator chooses
An administrator sets which Claude models plan the company’s designs and which is the default. A planning run never uses a model outside that list.
- Bring your own model key
Your company’s own Anthropic key, checked with the provider before it is stored, sealed with AES-GCM and shown back only as a hint.
Audit and monitoring2 in force
- A full company activity log
Invitations, roles, policies, model keys, saves and runs, in a log your administrator reads, exports as CSV and keeps for as long as you set.
- Signed webhooks
Events sent to your own systems are signed with HMAC-SHA256. When you rotate a company webhook’s secret, the old one keeps signing for a day.
Data lifecycle1 in force
- Export and delete at any time
Download an account or a whole company as one file. Deletion takes effect after 30 days and can be withdrawn until then.
The security page describes each of these in full.
AI and your material
No training. Nordform does not train or fine-tune any model on your designs, briefs or documents, and what is learned from one company's designs is never pooled with or shown to another company.
Which models read what. In the workspace, a model reads only what the operation you ask for needs, and each provider is named in the privacy policy with what it receives and when. Files are stored in the EU. An AI request can be processed outside the EU, depending on the provider.
Assignments our engineers deliver. When our engineers work on your project material, they use Claude under enterprise licences, processed in the EU with zero data retention: the provider keeps neither the input nor the output once a request is answered.
If no model may read it. Mark a company design confidential and no model reads it. Parts of the work are then done by hand.
If it may not leave your network. We can scope an isolated delivery, run in an environment with no connection to outside services. It is agreed separately for each case and is not a standard product today.
Tell us which of these your project needs before work starts, and we write it into the agreement.
Providers
These are the providers a security review asks about first. The privacy policy is the complete list, with what each receives and when. Company administrators are emailed at least 30 days before a provider is added.
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare | Hosting, database, private file storage, job infrastructure and email | File storage in Cloudflare’s EU jurisdiction |
| Anthropic | Claude models that plan design changes, read drawing sets and word notices | United States company; see “AI and your material” |
| Cloudflare Workers AI | Models on Cloudflare’s network: checks on a run, meeting summaries, sorting hub messages, reading an import when asked | Cloudflare’s network |
| Google (Gemini) | Makes an illustrative image or video from a rendered preview, only where the feature is used | |
| Recall.ai | Meeting note-taker, only on calls it is sent to | EU, Frankfurt |
| PostHog | One app-open event, without names, briefs, file names or contents | EU |
| PandaDoc | Electronic signature of contracts and agreements | United States |
Documents
- Security overviewPublic
- Privacy policy and provider listPublic
- TermsPublic
- Vulnerability disclosure (security.txt)Public
- Current security controls and policiesOn request
- ISO/IEC 27001 and SOC 2 programme statusOn request
Reporting a vulnerability
Write to security@nordformgroup.com with what you found and how to reproduce it. We answer within two working days. The security page sets out how we handle a report.
Explore Nordform ↗