Your data, protected and kept in the EU
Northmap holds your application catalog, your requirements and your decisions. This page sets out how we protect them: who runs the service, where the data lives, how it is encrypted and who can see it.
- Operated by
- Northmap SAS, France
- Customer content hosted in
- European Union (Belgium)
- Encryption
- TLS in transit, AES-256 at rest
- Sign-in
- SSO with Google and Microsoft Entra ID, 2FA
- AI model training
- Never on customer data
How we protect your data
Controls at every layer, from the infrastructure to who can open a workspace.
- Encryption in transit and at rest
- All data is encrypted in transit with TLS and at rest with AES-256.
- Authentication
- Two-factor authentication, and single sign-on with Google and Microsoft Entra ID accounts.
- Secure hosting
- Enterprise cloud infrastructure with firewalls, system monitoring and real-time alerts.
- Vulnerability testing
- We run regular vulnerability assessments, internally and through external security auditors, to find and address potential risks.
- Backup and recovery
- Systems and data are backed up automatically every day, under a data retention policy, for business continuity.
- Role-based access
- Access to workspaces and data is restricted per user and per account, with role-based permissions.
- Tenant isolation
- Each customer's data is kept fully separate from other customers' data.
- Application security
- Our engineers follow industry security practices, including OWASP principles, throughout development.
Your data and AI
Northmap uses AI to draft requirements, find options and score them. Your data serves that work, for you, and nothing else.
- Never used to train AI models
- Your catalog, requirements, evaluations and decisions are never used to train AI models.
- Used only to provide the service
- Customer data is used solely to provide Northmap to you. We do not use it for our internal systems or share it for any other purpose.
- A person decides
- The AI drafts, searches and scores. A person reviews the work and records the decision.
Compliance and audit
Our information security management follows ISO 27001 practices, and our handling of personal data follows the GDPR.
- Change history
- Changes are logged in a history you can search, so actions in the platform can be traced and reviewed.
- Integrations under the same rules
- Connections to third-party systems, such as Jira or Azure DevOps, are managed per user and per account, inside the same access boundaries.
- GDPR
- Northmap SAS processes customer data on your behalf under a Data Processing Agreement (GDPR Article 28).
Trust documents
Northmap is operated by Northmap SAS, a French company. Customer content is hosted in the European Union (Belgium).
- Data Processing AgreementGDPR Article 28 terms for customer data
- Privacy PolicyHow we handle personal data
- Terms of ServiceThe agreement for using Northmap
- Legal noticeCompany details and hosting provider
Need our subprocessor list, a security questionnaire or a countersigned DPA? Email contact@northmap.ai
See Northmap on one of your real demands
Bring a request you are working on. In 30 minutes we show you the requirements, the reuse and market options, and how the decision would be recorded.