Security & privacy
Your documents stay yours
Protecting your documents is built into how Normfluss is engineered, not layered on top. Here is what we can point to in the system itself — not what we promise, but what the architecture enforces.
- EU residency enforced at boot
- Database-level tenant isolation
- No staff interface to read your files
Straight answers for your security review
The questions a security or procurement team asks first — answered from what the system actually does.
- Can Normfluss staff read my documents?
- No. There is no interface through which Normfluss staff can read your document content — it is a property of the architecture, not a policy we ask you to trust.
- Where is my data processed?
- On German / EU infrastructure. EU residency is enforced when the service starts — the service refuses to run outside the EU region — rather than being promised in a policy.
- Is my data isolated from other customers?
- Yes, at the database level. Every tenant table is protected by forced PostgreSQL row-level security, scoped to your organization, and the service refuses to start in production without it.
- What happens to a document I check without an account?
- If you run a free check and don't create an account, the document is hard-deleted from storage automatically within 72 hours, and a content-free record of the deletion is written to the audit log.
- Is there a record of what happened to my documents?
- Yes. Actions are written to an append-only audit log enforced at the database level — updates and deletes are blocked by both revoked permissions and a trigger — and the log never stores your document text.
- How are credentials protected?
- API keys are shown once and stored only as an argon2id hash — never in plain text. The key that signs your evidence is itself stored encrypted, and production will not start without that protection in place.
How it is enforced
Tenant isolation
Forced PostgreSQL row-level security scopes every query to your organization. The service refuses to start in production with it disabled.
EU data residency
Processing runs on German / EU infrastructure, with residency checked at startup — the service will not run in another region.
Append-only audit log
Actions are recorded in a log that cannot be updated or deleted — enforced by revoked permissions and a database trigger — and never holds your document text.
No staff read-path
There is no interface through which Normfluss staff can read your document content. It is structurally true, not a policy.
Credentials at rest
API keys are argon2id-hashed and shown once; the evidence signing key is stored encrypted, required before production will start.
Human in the loop
A person reviews and dispositions machine findings before a document is finalized, with each decision attributed to the reviewer.
Evidence you can verify without us
Every finalized document comes with a signed record of what was checked, what a human decided, and what was out of scope. We publish the public signing key, so anyone can verify that record independently — it proves the evidence was signed by that key, and it keeps working even if the document itself has been deleted.
Security questions
- Do you certify that my document is legally compliant?
- No. Normfluss reports technical conformance against a stated testing scope — PDF/UA-1 and the PDF-applicable subset of WCAG 2.1 AA. Whether that meets a legal obligation stays your call, with your advisers.
- Can I verify the evidence without contacting you?
- Yes. We publish the public signing key, so a third party can verify an evidence signature themselves with any standard cryptography library — it proves the record was signed by that key.
- Is a human involved before a document is finalized?
- Yes. A person reviews and dispositions the machine findings before a document is finalized, and each decision is attributed to the reviewer who made it.
- How is the connection secured?
- All traffic is over HTTPS with HSTS, a strict content-security policy, and session cookies that are http-only and same-site.
Normfluss reports technical conformance against a stated testing scope. It does not provide legal certification or legal advice.