Trust Center
The diligence pack for security, privacy and procurement.
Where a CISO, DPO or procurement lead starts with Northdocs: the published documents, where customer data is hosted and who touches it, how AI is controlled, and what is and is not certified today.
Updated 24 October 2026
- Hosted in FrankfurtCustomer documents on OVHcloud, Germany
- AI can be switched offOrg-wide, then no content goes to any AI provider
- Fail-closed PDF exportBlocked until verification finds no survivors
- Not yet certifiedSOC 2 and ISO 27001 are on the roadmap
- Danish companyNorthdocs ApS, EU contracts and DPA
Documents
Start with the papers your review needs.
Every document is public and dated. Grouped by who usually asks for it; open any of them without an account.
Security and IT
For the CISO, InfoSec and IT architecture review.
- Security OverviewFail-closed PDF verification on the Finalize / verified PDF path: export stays blocked until verification finds no unexpected survivors. Native Office formats and some binder or acknowledged-unredacted exits have separate rules. Prefer a verified PDF when you need that guarantee. EU residency on OVHcloud Frankfurt, isolated PDF/OCR, Enterprise envelope encryption with optional Azure Key Vault BYOK, AI kill-switch, backups and recovery, secure development, incident response, and vulnerability reporting.Updated 12 September 2026
- ArchitectureTrust boundaries, processing pipeline, residency, encryption (including BYOK), resilience and change control, Conversation Redact speech-to-text, and optional Outlook send-time protection.Updated 12 September 2026
- Security questionnaireSIG-lite Q&A for vendor assessments: hosting, SSO, AI, connectors, resilience, secure development, incident response, certifications roadmap, and contacts.Updated 14 October 2026
Privacy and data protection
For the DPO, privacy counsel and the Article 28 file.
- Data Processing AddendumDownloadable and in-app e-accept Art. 28 DPA for customer documents, cases, and related processing.Updated 14 October 2026
- SubprocessorsArticle 28 register: OVHcloud (hosting and optional AI), Scaleway TEM, Clerk, Stripe, and customer-configured connectors.Updated 12 September 2026
- Enterprise AI PolicyOptional OVHcloud AI Endpoints from the EU app for NER, Magic, summaries, Prompt Guard, Outbound Guard names, and Conversation Redact speech-to-text, plus the organization kill-switch.Updated 7 September 2026
- Privacy PolicyController versus processor roles, documents, Outlook telemetry, conversation audio, Prompt Guard, retention, and rights.Updated 14 October 2026
- Cookie PolicyStrictly necessary Clerk and locale cookies, no advertising cookies, and how to manage them.Updated 31 August 2026
Procurement and legal
For contract, accessibility and commercial review.
- Terms of Sale & ServiceCommercial terms, human-review responsibility, warranties, and availability language.Updated 14 October 2026
- AccessibilityWCAG 2.1 AA statement: conformance status, axe-core CI, scope (including Help and the app shell), known limitations, and a five-business-day feedback target.Updated 31 August 2026
- MSA and Enterprise SLA (drafts)Draft paper for counsel and deal review, not final contract terms. Request a copy from legal@northdocs.com
Hosting and data flows
Where customer data goes, and who else sees what.
Customer documents are hosted and processed in the EU. A few vendors outside that boundary handle sign-in and payments, and they are listed here with the transfer basis.
Documents stay on EU infrastructure
Uploaded documents, extracted text and detections are stored and processed on OVHcloud in Frankfurt. The PDF and OCR engine runs on a private network with no outbound internet access.
Sign-in and payments are not EU-only
Clerk (authentication) and Stripe (payments) are US and EU vendors under Standard Contractual Clauses. They receive account and billing data, not customer documents.
Email notices carry no document content
Transactional email goes through Scaleway in France. Messages never include document filenames, extracted text, detections or case contents.
| Vendor | Role | Location | Transfer basis |
|---|---|---|---|
| OVHcloud | Infrastructure | Germany / European Union (Frankfurt, default data region eu-de) | EU processing for application data under OVHcloud DPA / SCCs as applicable |
| Scaleway | Infrastructure | European Union (France) | EU processing under Scaleway DPA |
| Clerk, Inc. | Identity & billing | United States / EU (Clerk infrastructure) | Standard Contractual Clauses (SCCs) and Clerk DPA |
| Stripe, Inc. | Identity & billing | United States / European Union (Stripe infrastructure) | Standard Contractual Clauses (SCCs) and Stripe DPA |
| OVHcloudOptional | AI processing | European Union (OVHcloud AI Endpoints) | EU processing under the OVHcloud DPA. Northdocs calls OVHcloud AI Endpoints over HTTPS from the EU-hosted application. Staging and production customer inference does not use OpenAI or Mistral. |
AI controls
AI is optional, runs in the EU, and can be switched off.
Detection does not depend on AI. Rules and a local entity model do the first pass on Northdocs infrastructure; AI only adds specialist categories and assistance when the organization allows it.
- 01Pattern rulesStructured identifiers such as CPR, IBAN and payment cards are matched on the platform, with checksum validation where the format has one.
- 02Local entity modelNames, places and organizations in Danish, Norwegian, Swedish and English are tagged by a model that runs on Northdocs infrastructure.
- 03Optional AI in the EUSpecialist categories, Magic Redact, summaries and speech-to-text use OVHcloud AI Endpoints in the EU.
An admin can turn off AI and ML detection for the whole organization in Settings. Document content and detection text are then not sent to any AI provider. Recordings without captions then need a WebVTT or SubRip file.
Scope and roadmap
What is true today, and what is not yet.
Northdocs is EU-first SaaS with published controls. For procurement, here is the current status on common diligence items:
SOC 2 and ISO 27001: not certified today.
Both are on the roadmap. Physical and datacenter certifications are inherited from OVHcloud. Ask legal for the latest status letter.
- AI processingProduction AI uses OVHcloud AI Endpoints in the EU (NER, Magic, summaries, Prompt Guard names, Outbound Guard names, and Conversation Redact speech-to-text). Organization admins can disable AI / ML detection under Settings so document content is not sent to an AI provider. Audio without captions then needs a WebVTT or SubRip sidecar. Questions: support@northdocs.com.
- Uptime SLAQuantitative commitments are available on Enterprise by written agreement. A public status page is forthcoming. Incident notices for affected customers go through support and email.
- Data residencyGermany / EU by default (OVHcloud Frankfurt, data region eu-de). US residency is not offered.
- IdentityEnterprise SSO/SAML is available. SCIM (join/move/leave) is offered via Clerk Directory Sync on Enterprise connections; ask sales to enable for your tenant.
- PaymentsStripe processes self-serve checkout and invoices. Northdocs does not store full card numbers. See Subprocessors.
- Encryption at restOVH S3-compatible object storage (Germany) by default. Enterprise can enable per-document envelope encryption and optional Azure Key Vault BYOK (customer CMK wraps the organization key; Northdocs never stores the CMK). At-rest object storage only; not in-memory processing. See Security Overview, Architecture, and the Security questionnaire.
- Outbound GuardOutbound Guard warns or SoftBlocks in Outlook at send time when it can run. If the add-in does not run, Outlook can still send. It complements Microsoft 365 DLP. It is not a Purview or mail-flow hard block.
- Verified PDF exportOn the Finalize / verified PDF path, export stays blocked until verification finds no unexpected survivors. Native Office formats and some binder or acknowledged-unredacted exits have separate rules. Prefer a verified PDF when you need that guarantee.
- Outlook telemetryDPIA and accountability exports exclude message bodies and raw CPR. Cloud scan and optional intent AI process compose text in Northdocs when enabled; that is detection processing, not long-term body storage. Telemetry stores mailbox, finding counts, destination class, and domains.
- ResilienceAutomated daily database backups to EU object storage in the same region, with restores rehearsed on isolated infrastructure. Northdocs runs in a single EU region by design, so there is no cross-region failover that would move documents outside the agreed region. RTO and RPO targets are available on Enterprise by written agreement.
- Incident responseSecurity and availability events are triaged on detection. For a personal data breach affecting customer personal data, Northdocs notifies affected customers without undue delay with the information needed for Article 33 and 34 obligations. The binding commitment is in the DPA; escalation goes to security@northdocs.com.
- Change controlProduction changes go through peer-reviewed pull requests with type checking and an automated test suite, including pinned regression tests for tenant isolation, fail-closed PDF verification, and outbound URL filtering. Physical and datacenter certifications are inherited from OVHcloud.
Availability
Availability
Standard Terms do not include a public quantitative uptime commitment. Enterprise customers can agree a written SLA in the Order Form / MSA.
A public status page is forthcoming. Incident notices for affected customers go through support and email. The page will cover the app, OVHcloud AI Endpoints, Clerk, and the PDF/OCR container once it is live.
Contact
Talk to the people who answer diligence.
- Security / vulnerability reportssecurity@northdocs.comAcknowledge within 2 business days; status update within 10 business days.
- Privacyprivacy@northdocs.comData protection questions and DPA coordination.
- Legal / negotiated paperlegal@northdocs.comMSA, countersigned DPA, status letters, Enterprise commercial terms.
- Sales / Enterprise evaluationsales@northdocs.comTrials, bake-offs, invoice licensing, SSO onboarding.
Northdocs ApS | CVR 46848195 | Magledalen 124, 2, 4700 Næstved, Denmark