Security, data residency and sub-processors
Where data is stored, who processes it, who can see it, and how to get the security pack.
How it works
nørma runs on Amazon Web Services in its Sydney region. Accounts, check-ins, reflections and voice recordings are stored there, encrypted at rest, and the apps reach it over encrypted connections.
One part runs outside Australia. When someone saves a reflection, its text, their latest check-in answers and the names of habits and growth work they’ve chosen go to Anthropic, a third-party AI provider, to write that person’s mirror, suggest small steps and note themes. The request carries no name, email or organisation. Reflections are the only thing nørma uses AI for. Spoken reflections are turned into text on the person’s phone.
Step by step
- Ask your nørma contact for the security pack.
- Share it with your IT, privacy and procurement teams.
- Send follow-up questions back through your nørma contact.
Good to know
Employers see group figures only, for groups at or above your organisation’s minimum. Admins see roster details: name, email, team, role and sign-in status.
People sign in with a password of at least 12 characters, mixing upper and lower case, a number and a symbol, or through your own identity provider with single sign-on (SAML 2.0 or OpenID Connect), set up by AOH.
When someone deletes their account, or is removed, their data is erased after 30 days.
This page isn’t a full sub-processor list or a contract term. Rely on the security pack and your agreement.
Group figures only, never a person’s answers. Groups below your organisation’s minimum never show, and in a small group a figure can rest on one answer.
Still need a hand?
Contact your nørma contact. They can help with setup, sign-in, your agreement and anything this help centre doesn’t answer.
Need someone to talk to now? See When you need more support.