Security

Protections on the live service

Each of these is enforced by the product itself, today.

• EU

  Files stored in the EU

  Every upload and every generated file sits in private storage in Cloudflare’s EU jurisdiction.

• Your key

  Bring your own model key

  Your company’s own Anthropic key, checked with the provider before it is stored, sealed with AES-GCM and shown back only as a hint.

• Your models

  Claude models your administrator chooses

  An administrator sets which Claude models plan the company’s designs and which is the default. A planning run never uses a model outside that list.

• Sealed

  Confidential projects

  Mark a project confidential and only the people named on it can open it. No model reads it, and it never feeds company learnings.

• Never trained

  Your designs train nothing

  Nordform has no training or fine-tuning path. A model proposes typed data, and our own deterministic code checks and builds it.

• Hashed

  Sessions and tokens stored as hashes

  Session cookies are host-only, Secure and HttpOnly. Sessions, API tokens and sign-in links are kept only as hashes.

• Logged

  A full company activity log

  Invitations, roles, policies, model keys, saves and runs, in a log your administrator reads, exports as CSV and keeps for as long as you set.

• Yours

  Export and delete at any time

  Download an account or a whole company as one file. Deletion takes effect after 30 days and can be withdrawn until then.

Certifications

We are building our information security management system to ISO/IEC 27001 and preparing for a SOC 2 examination covering security, availability and confidentiality. Customers working with us during the programme can ask for our current controls, policies and progress at security@nordformgroup.com.

• ISO/IEC 27001In progressInformation security management
• SOC 2In progressSecurity, availability, confidentiality

Models and your designs

Your company decides which Claude models plan changes to its designs. An administrator sets the allowed models and the default, and every planning run stays inside that list. A company can bring its own Anthropic key: we check it with the provider before storing it, seal it with AES-GCM bound to your company, and show it back only as a hint. Runs on your designs then use your own account with the provider, under your own agreement with them.

Nordform does not train or fine-tune any model on your designs, briefs or documents. A model reads your request and proposes a change as typed data; our own deterministic code validates that proposal against a schema and builds the geometry. A model never runs code against your design and never produces a check result.

For the most sensitive work, mark a project confidential: only the people named on it can open it, no model reads it, and nothing from it feeds company learnings. Each provider that processes data, and for what, is listed in the privacy policy. Company administrators are emailed at least 30 days before a provider is added.

Where your data lives

Access and accounts

• Sign-in with Google, Microsoft or a single-use email link bound to your browser. We store no passwords.
• Sessions use host-only, Secure, HttpOnly cookies and expire after seven days. Sessions, API tokens and sign-in links are stored only as hashes, so a copy of our database holds nothing that signs anyone in.
• Company roles: owners, administrators and members, with viewer or editor access per design. Only the owner promotes administrators, and an invitation is accepted only from a verified email address.
• Every company request is checked against your current membership, and a disabled account loses access at once. Returning to a tab re-checks your session and access.
• Share links and company shares give read access to one revision only; project members are added as editors, commenters or viewers by name. A preview link can carry a password and an expiry, and you can revoke it at any time.
• API and MCP access uses scoped, rate-limited tokens and OAuth 2.1 with PKCE; refresh tokens rotate on every use.
• Our own operator and internal tools sit behind Cloudflare Access, with a signed identity verified on every request.

Audit and control

Company administrators see a full activity log: invitations, role and policy changes, model and key changes, saves, runs and exports. Download it as CSV and choose how long it is kept, up to ten years or for good. Outbound webhooks are signed with HMAC-SHA256 so your own systems can follow the same events.

Editing safely together

Two browsers editing the same project never overwrite each other. In a personal project the later save waits until you open the latest version or keep your copy as a new project. On a company design it is combined with the newer version, and refused if both changed the same part differently. Every save is a version you can return to.

Your data, your decision

Download your account, or a whole company, as one file at any time. Deleting an account or a company takes effect after 30 days and can be withdrawn until then; stored files are deleted first, then the records. Take the export before deleting, because it cannot be produced afterwards. The privacy policy explains how personal information is handled.

Reporting a vulnerability

Write to security@nordformgroup.com with what you found and how to reproduce it. We answer within two working days, keep you informed until it is fixed, and credit you if you wish. We will not pursue anyone who reports in good faith, stays within their own accounts and data, and gives us reasonable time to fix the issue before disclosing it. Our security.txt carries the same contact.