Trust centre

What we ask of you, we publish about ourselves

Procurement asks these questions of every supplier. Ours are answered here rather than in a questionnaire, including the two we cannot answer with a yes.

Posture

Six claims, and what backs each one

Two of these are a no. A trust page that is all green ticks is a brochure.

  • ISO 27001

    In place

    Certified since 2021, scope covering the SOC, the offensive practice and corporate IT.

    Certificate on request

  • PASSI qualification

    In place

    Qualified for penetration testing and security audit under the French scheme.

    ANSSI register

  • SOC 2 Type II

    Not held

    Not held. Our clients are European and have not asked for it; we will not claim a control we have not been audited against.

    —

  • Data residency

    In place

    All client telemetry stays within the European Union. No processing, storage or support is subcontracted outside it.

    Subprocessor list below

  • Penetration testing of our own estate

    In place

    Annually, by an independent firm we do not subcontract to. The summary goes to clients under NDA.

    Summary on request

  • Public bug bounty

    Not held

    Not run. We operate a coordinated disclosure policy instead, described below, and pay for findings case by case.

    Disclosure policy
Subprocessors

Everyone who could touch your data

The full list, not the ones that are convenient to mention. Changes are notified to clients thirty days before they take effect.

Cloud infrastructure

Scaleway — Paris (FR)

SOC platform and log storage

Object storage

OVHcloud — Gravelines (FR)

Evidence archives, encrypted at rest

Email

Infomaniak — Geneva (CH)

Corporate mail, adequacy decision in force

Ticketing

Self-hosted — Rennes (FR)

Engagement tracking, on our own hardware

Coordinated disclosure

Found something in our estate?

We are an offensive security practice. Being told we have a problem is the outcome we want, not the one we litigate.

  1. 01

    Send it

    Encrypted to our disclosure key, to security@norva.com. Include enough to reproduce it.

  2. 02

    We acknowledge

    Within two working days, by a human, naming who is handling it.

  3. 03

    We fix

    Ninety days is our own deadline. You get told when it ships, not when the quarter ends.

  4. 04

    You publish

    On your timetable, not ours. We will not ask you to wait and we will never involve lawyers first.

Disclosure key fingerprint

0xB4 21 9C 7E 3A 55 D0 1F
Report to security@norva.com