Security and trust
Your data. Your jurisdiction. Your rules.
Governance before automation, every time. North Stack is built for regulated businesses, with its controls enforced in code.
How we protect it
Controls you can check.
Eight things that hold for every portal North Stack builds.
A deployment of your own
Each business gets its own database, file storage, model gateway, sign-in and secrets. Nothing is shared with another customer.
Data where you choose
Your database and files are created in the region nearest your country. Guaranteed jurisdiction, such as the EU, is a paid add-on, and on-premises AI keeps it inside your walls.
No passwords to steal
People sign in with a code emailed to their work address. Only your own domain can sign in, and only by invitation.
Read-only connections
Connected systems are read, never changed by the assistant. The business decides what each connector can see.
People approve actions
Anything that changes another system is prepared as a plan and runs only after a named person approves it.
A complete audit trail
Every sign-in, read and change is recorded and cannot be edited. What people write is never stored in the trail.
Private by person
Conversations, personal instructions and routines belong to the person who made them. Admins cannot read them.
Your data stays yours
North Stack does not train models on your data, and payload logging and caching are switched off on your model gateway.
Security in depth
What a security review finds.
How those controls are built, for the people who have to check them.
Checked on the server, every time
Every request is checked against the person's role, department, team and name before it runs. Another business's records answer as if they do not exist.
Connections and secrets sealed
Connection tokens are sealed with keys only your deployment holds, never shown in the interface or written to logs. A business connection uses a dedicated shared account; a personal one must match the person's own sign-in.
Sign-in that resists guessing
Codes are single-use and expire within minutes, repeated attempts are limited, and every sign-in is recorded with who, when and how.
AI that cannot act alone
The assistant writes drafts. Every tool it uses can only read, checked in code where the tools are assembled and again before the model is called.
Memory kept in its lanes
Memory is held per business, in separate business, personal, project and conversation scopes. Nothing from a private chat reaches the business's memory, and removing a person removes theirs.
Retention you set, deletion you see
Retention periods are set for each kind of data. Deleting all of a workspace's data is requested, can be cancelled, and is recorded.
Compliance
Evidence you can show a regulator.
Governance reports are built on demand from your own audit trail and mapped to the control families of the frameworks you work to, including UK GDPR. They are evidence for those controls. North Stack does not claim certification it does not hold, and data placement by country is a preference unless you choose guaranteed jurisdiction.
Certification readiness
Ready for the audits your clients ask for.
Every portal maps its controls to six frameworks and builds evidence reports from its own audit trail on demand: the groundwork an auditor or certification body examines. North Stack holds no certification today. Those are issued only by independent auditors and accredited bodies.
SOC 2
AICPA Trust Services Criteria (2017, points of focus revised 2022)
Security, availability and confidentiality, for service audits.
8 controls mappedEvidence on demand
Evidence for the common criteria a SOC 2 examination tests. A SOC 2 report is issued only by an independent auditor.
ISO/IEC 27001
ISO/IEC 27001:2022, Annex A
An information security management system.
12 controls mappedEvidence on demand
Evidence for the Annex A controls named here. Certification is given only by an accredited certification body.
ISO/IEC 42001
ISO/IEC 42001:2023, Annex A
An AI management system: responsible, overseen use of AI.
8 controls mappedEvidence on demand
Evidence for the Annex A controls named here. Certification is given only by an accredited certification body.
GDPR
UK GDPR and EU GDPR (Regulation (EU) 2016/679)
Personal data: accountability, security and where it is held.
10 controls mappedEvidence on demand
Evidence for the organisation's own GDPR records. It does not replace its record of processing or its data protection impact assessments.
HIPAA
HIPAA Security Rule, 45 CFR Part 164, Subpart C
US health information: access, audit and integrity safeguards.
9 controls mappedEvidence on demand
Evidence for the Security Rule safeguards named here. Holding protected health information also needs business associate agreements with the provider and the services listed, which this report does not establish.
FedRAMP (Moderate)
FedRAMP Moderate baseline, NIST SP 800-53 Rev. 5
US federal cloud services, at the Moderate baseline.
12 controls mappedEvidence on demand
Evidence for the NIST SP 800-53 controls named here. It is not a FedRAMP authorisation, which only an authorising agency or the FedRAMP Board grants.
Controls and red lines
A person signs off. Every time.
These controls are in every build from the first sprint, not added once something goes wrong.
- A person signs off every disclosure before it leaves the system
- Confidence scores, so a reviewer sees which values to check
- Role-based access, so people see only what their role permits
- A complete, exportable audit trail from source record to final statement
Permanent red lines
- No automated payments, and no automated changes to bank details. Ever.
- A hard human gate before any submission to a regulator. No exceptions.
Not configurable. They stay in place whatever the workflow is worth.
Where we are, stated plainly
North Stack holds no formal security certification today: not Cyber Essentials, not ISO 27001. If certification is a hard requirement for your procurement, tell us at the first conversation rather than the last.
Trust and due diligenceWhere it runs
Near you, guaranteed, or on your own hardware.
Choose the country your data lives nearest, add guaranteed jurisdiction when the rules require it, or run AI inside your own infrastructure.
Country chosen at sign-up
United Kingdom
Data placed in
Western Europe
- Western Europe
- Eastern Europe
- Western North America
- Eastern North America
- Asia-Pacific
- Oceania
Need a guarantee? Guaranteed jurisdiction keeps data inside the EU or the US.
Questions
What security teams ask.
Where is our data stored?
In your portal's own database and file storage, created in the region nearest the country you choose. Guaranteed jurisdiction, such as staying within the EU, is a paid add-on, and on-premises AI keeps it inside your own infrastructure.
Is our data used to train AI models?
No. North Stack does not train models on your data, and payload logging and caching are switched off on your model gateway.
Is North Stack multi-tenant?
No. Each business gets its own deployment: its own database, file storage, sign-in, secrets and model gateway settings. Nothing is shared with another customer's portal.
Which AI providers do you use?
Your administrators choose the model for your workspace from leading model makers, and can change it at any time. Your data and AI inventory names where data is held and every AI provider in use.
Can North Stack's team see our conversations?
No. North Stack's management access excludes conversations, personal memory, instructions and connections, and everything it does is recorded as North Stack in your own audit trail.
Do you hold SOC 2 or ISO 27001?
Not today. Every portal maps its controls to SOC 2, ISO/IEC 27001, ISO/IEC 42001, GDPR, HIPAA and FedRAMP Moderate, and builds evidence reports from its audit trail for an auditor to examine. Certification is issued only by an independent auditor or accredited body.
How do we report a security issue?
Email hello@northstack.digital with "Security" in the subject. We investigate every report and keep you updated.
Your company's AI is a few minutes away.
Enter your work email and website. We read your brand, build your private portal and sign you in.