Security & Governance
AI your security and privacy teams can approve.
We design private AI systems the way regulated organizations need them: data kept in place, access tied to identity, every action attributable, and evaluation built into the lifecycle.
Design principles
Six principles behind every system we build.
Data stays in your environment
Models, indexes, prompts, outputs and logs reside on infrastructure you control. Systems we build do not require calls to third-party model providers.
Least privilege, per user
Assistants and agents act with the permissions of the person using them — never a shared super-user. Retrieval respects source-system access.
Everything is attributable
Queries, retrieved documents, tool calls and approvals are logged with user identity and exportable to your SIEM.
Humans approve what matters
Consequential or irreversible actions require explicit human approval. Automation boundaries are documented and reviewable.
Evaluated before deployed
Models and changes are tested against task-specific evaluation sets and adversarial scenarios before release, and re-tested when they change.
Known provenance
Model weights, datasets and dependencies are sourced, versioned and documented so you know exactly what is running.
AI-specific risk
Controls for the threats that are new.
Language models introduce risks that traditional application security doesn't fully cover. We address them explicitly.
| Threat | Control |
|---|---|
| Prompt injection | Input isolation, tool-scope limits and approval gates on sensitive actions |
| Sensitive information disclosure | Permission-aware retrieval, output filtering and data-loss prevention |
| Excessive agency | Narrow, purpose-built tools with explicit, least-privilege scopes |
| Supply-chain risk | Verified model sources, pinned versions and dependency review |
| Unreliable output | Citations, evaluation sets and guidance on verification for users |
| Unmonitored use | Usage analytics, audit trails and periodic governance review |
Frameworks
Mapped to the obligations you already carry.
We design controls and documentation to support your compliance with the following frameworks. Responsibility for compliance remains with your organization; our role is to make it demonstrable.
PIPEDA & provincial privacy law
Including Québec's Law 25 and provincial health information statutes.
Directive on Automated Decision-Making
Treasury Board of Canada Secretariat requirements, including the Algorithmic Impact Assessment.
ITSG-33
IT security risk management guidance from the Canadian Centre for Cyber Security.
NIST AI Risk Management Framework
Govern, map, measure and manage functions for AI-specific risk.
ISO/IEC 42001
AI management system practices for organizations pursuing certification.
OWASP Top 10 for LLM Applications
Controls for prompt injection, data leakage, excessive agency and related risks.
Our conduct
How we handle your environment.
- We work inside your environment, under your access controls and change-management process.
- We request only the access an engagement requires, for the time it requires it.
- We do not copy your data to our own systems for development or testing without written approval.
- We can work within your personnel security screening and confidentiality requirements.
Vulnerability disclosure
Reporting a security issue
If you believe you have found a security vulnerability in this website or in a system Norclave operates, please email contact@norclave.ca with a description and steps to reproduce. We will acknowledge your report, keep you informed and ask that you allow reasonable time for remediation before any public disclosure. Machine-readable contact details are published at /.well-known/security.txt.
Bring your security team to the briefing.
We're glad to walk your security, privacy and architecture reviewers through how we build and how we work.
Start a conversation