Security & privacy
A security product should itself be trustworthy.
Noroshi exists to protect small and medium-sized European organisations. That only works if you can trust the watcher. Here is exactly what we do, and just as importantly, what we never do.
Our principles
- EU-only. Hosting, data, e-mail delivery and every subprocessor are located in the European Union. We do not use any non-EU service to operate this product.
- Nothing on your website. No tracker, no script, no cookie, no pixel. Noroshi observes your external posture from our own infrastructure.
- Verification before scanning. Deep scans run only on domains where ownership is proven via a DNS TXT record. We never scan domains that cannot be verified.
- Deterministic findings. Every alert is produced by a fixed, reproducible check with a concrete fix. We do not send AI-generated speculation.
- Data minimalisation. We store what the checks need and nothing more: no end-visitor data, no full page bodies (only hashes and structural metadata).
- You own your data. Domain deletion is self-service, full export and account deletion are available on request. Retention limits are documented per data type.
Built around ISO 27001
Noroshi is not certified against ISO 27001. We say so plainly. What we can say: the product, our procedures and our hosting choices are designed around the same requirements for information security management, and the practices below run in production today. A formal certification is a planned next step, not a present claim.
- Access control. Every dashboard action checks role and ownership server-side. Owner-only actions such as invites, workspace deletion and billing cannot be reached by other team members.
- Secure development. Type checking, linting and automated tests gate every change. Outbound requests made by our scanner are validated against a strict allow-policy.
- Backups & recovery. Nightly encrypted database backups, kept 14 days, on our own EU infrastructure.
- Auditable events. Scans, alerts, verification steps and payments are logged so every outcome can be traced to its cause.
- Incident handling. Security reports reach a monitored mailbox and are answered promptly. Production incidents get a dated entry in our internal records.
What we never do
- ✕ Run penetration tests, exploit payloads or credential attacks against your systems. We observe the outside, we never attack.
- ✕ Place cookies or tracking on your website, or profile your visitors in any way.
- ✕ Sell, share or monetise your data. Your scan results belong to you.
- ✕ Scan domains without verified ownership.
- ✕ Use non-EU cloud services, fonts or scripts anywhere in our product.
Subprocessors & data locations
A short, deliberate list. Everything inside the EU.
Hosting & data
Application and database run on Hetzner infrastructure in Germany (Nuremberg). Nightly encrypted database backups.
E-mail delivery
Transactional e-mail (alerts and account e-mails) is delivered by Lettermint, an EU-based e-mail provider.
Payments
Subscriptions are processed by Mollie, an EU-based payment provider. Card data never touches our servers.
Threat intelligence
Abuse blocklist data is fetched from public, community-maintained feeds and stored on our own EU infrastructure.
Questions or a security report?
If you found a vulnerability in our service, or if you have a question about how we handle data, e-mail us at info@noroshi.eu . We take every report seriously and respond promptly.