How we secure NorthIron
We hold ourselves to the controls we sell. This page sets out where your data lives, how evidence is protected, how access works, and how to report a vulnerability to us.
Why this matters for a compliance platform
Your evidence is sensitive by definition
A compliance platform holds architecture diagrams, access lists, policies and audit findings. It is a map of your weaknesses, and it has to be treated as one.
Residency is a contractual question
Regulated buyers need to know exactly where their data is stored and processed, including by any AI.
Sharing is where control is lost
Evidence that leaves the platform as a download can be forwarded, altered or kept long after an audit ends.
How the platform is secured
Hosted in India
NorthIron runs in AWS Mumbai. Evidence, audit data and the AI evidence review are stored and processed in region. Our subprocessors are listed on their own page.
Evidence integrity
Every artefact in the Evidence Vault is hashed with SHA-256 and versioned, with a collection date on each version, so what an auditor saw can be proved later.
Controlled sharing
Evidence is shared with auditors through scoped links. Documents are watermarked and view only, with download disabled, and access is time bound and revocable.
Read-only integrations
Connected cloud, identity and code systems are read, not written to. NorthIron collects what it needs as evidence and changes nothing in your environment.
Humans approve
The AI evidence review is advisory. Acceptance is a named practitioner's decision, recorded against their name.
Responsible disclosure
If you believe you have found a vulnerability in NorthIron, write to info@seccomply.net with the details. Please give us a reasonable chance to fix it before disclosing it publicly.
The same controls we ask of you
We run NorthIron on NorthIron. The controls, evidence and review that customers see are the ones we apply to ourselves.
In short
- Data stored and processed in AWS Mumbai
- SHA-256 hashing and version history on every artefact
- Watermarked, view-only, revocable auditor access
- Read-only access to connected systems
- A named person behind every approval
Questions we are asked about our security
Does NorthIron's AI send our evidence outside India?
No. The AI evidence review runs in AWS Mumbai, so evidence stays in region for processing as well as storage.
Can NorthIron change anything in our cloud accounts?
No. Integrations read configuration and activity to collect evidence. They do not write.
Where can we see your policies and subprocessors?
Our privacy policy, terms and subprocessor list are published under Legal in the footer. For anything else, ask us and a practitioner will reply.
Need more detail for a security review?
Ask us for our security pack. A practitioner will answer your questionnaire from the same evidence we run on.