Security & privacy

Your documents stay yours

Protecting your documents is built into how Normfluss is engineered, not layered on top. Here is what we can point to in the system itself. Not what we promise, but what the architecture enforces.

EU residency enforced at boot
Database-level tenant isolation
No staff interface to read your files

Straight answers for your security review

The questions a security or procurement team asks first. Answered from what the system actually does.

Can Normfluss staff read my documents?: No. There is no interface through which Normfluss staff can read your document content. It is a property of the architecture, not a policy we ask you to trust.
Where is my data processed?: On German / EU infrastructure. EU residency is enforced when the service starts, the service refuses to run outside the EU region, rather than being promised in a policy.
Is my data isolated from other customers?: Yes, at the database level. Every tenant table is protected by forced PostgreSQL row-level security, scoped to your organization, and the service refuses to start in production without it.
What happens to a document I check without an account?: If you run a free check and don't create an account, the document is hard-deleted from storage automatically within 72 hours, and a content-free record of the deletion is written to the audit log.
Is there a record of what happened to my documents?: Yes. Actions are written to an append-only audit log enforced at the database level, updates and deletes are blocked by both revoked permissions and a trigger, and the log never stores your document text.
How are credentials protected?: API keys are shown once and stored only as an argon2id hash. Never in plain text. The key that signs your evidence is itself stored encrypted, and production will not start without that protection in place.

How it is enforced

Tenant isolation

Forced PostgreSQL row-level security scopes every query to your organization. The service refuses to start in production with it disabled.

EU data residency

Processing runs on German / EU infrastructure, with residency checked at startup. The service will not run in another region.

Append-only audit log

Actions are recorded in a log that cannot be updated or deleted, enforced by revoked permissions and a database trigger, and never holds your document text.

No staff read-path

There is no interface through which Normfluss staff can read your document content. It is structurally true, not a policy.

Credentials at rest

API keys are argon2id-hashed and shown once; the evidence signing key is stored encrypted, required before production will start.

Two-factor authentication

Two-factor authentication on every account that turns it on.

Human in the loop

Findings that need a person stay open until you decide them, and each decision is attributed to the reviewer.

Evidence you can verify without us

Every finalized document comes with a signed record of what was checked, what a human decided, and what was out of scope. We publish the public signing key, so anyone can verify that record independently. It proves the evidence was signed by that key, and it keeps working even if the document itself has been deleted.

Security questions

Do you certify that my document is legally compliant?

No. Normfluss reports technical conformance against a stated testing scope. PDF/UA-1 and the parts of WCAG 2.2 AA that apply to PDFs. Whether that meets a legal obligation stays your call, with your advisers.

Can I verify the evidence without contacting you?

Yes. We publish the public signing key, so a third party can verify an evidence signature themselves with any standard cryptography library. It proves the record was signed by that key.

Is a human involved before a document is finalized?

Wherever a finding needs a person, yes. It stays open until you decide it, the document is never recorded as conformant while it is open, and each decision is attributed to the reviewer who made it. A document with nothing that needs a person is finished without one.

How is the connection secured?

All traffic is over HTTPS with HSTS, a strict content-security policy, and session cookies that are http-only and same-site.

Normfluss reports technical conformance against a stated testing scope. It does not provide legal certification or legal advice.