Autonomous IT operations under full control

Many times faster.Around the clock.Competent.

The AI colleague takes over what an IT colleague does remotely, everything except physical IT. 81% automated at our first customer, an IT service provider, October 2026. Controlled, auditable, hosted in Germany.

Watch the 100-second video

Built on BSI IT-Grundschutz++
KRITIS-compliant
NIS2-compliant
ISO 27001 in preparation
GDPR-compliant
Made in Germany

nordnung.ai in 100 seconds

The product flow at speed: from the call to the documented resolution.

Why now

Today the AI revolution ends at copy and paste.

nordnung.ai: what we do about it

> make shadow_ai visible

Visible, governable, auditable. ✓

What it takes over

Measured at our first customer, not estimated

1,000+

endpoints in production, as of 11/2026

81%

automated at our first customer, an IT service provider, October 2026

One third

of the cost for the same work

The standard cases

Password reset & account unlockfull
Onboarding new colleaguesapproval
Mailbox & folder permissionsfull
Licensing & standard softwarefull / partial
Offboarding & departuresfull

Read the case study →

Measured in a real stack:

Microsoft 365
Active Directory
Exchange & Outlook
Microsoft Teams
DATEV
3CX
Nextcloud
Terminal servers
MFP devices

* First pilot at our first customer, an IT service provider, every ticket individually classified. No extrapolation. “Approval” = the human share stays with you.

Same work, a third of the cost

One third

of the cost for the same work

~€20 per completed task, relative to one hour of IT work

external provider, per hour of IT workfrom €120
internal, full cost per hour of IT work€60
with nordnung.ai, for the same work~€20

Agent time included. No extra costs up to full utilization.

See pricing →

Scenario lab

Experience controlled autonomy

Real recordings from our demo environment

Reconnect Outlook

≈ 4% of all tickets · #4 in the dataset

After your approval, the Endpoint Agent turns off Outlook's offline mode and checks the outbox.

English narration and subtitles. Screen recordings use the German interface.

nordnung Cosmos

Two interaction agents stay close to the user. Four execution agents carry out defined actions in technical environments.

Phone Agent

Interaction agent

No system access

Can do:Handles phone and chat intake, captures context, and structures the request.

Cannot do:No direct system execution or privileged endpoint actions.

Protection:Session-bound scope with explicit handover into execution agents.

Examples:Initial triage, guided clarification, user-facing updates.

Vision Agent

Interaction agent

Image analysis for real devices

Can do:Analyzes uploaded photos to classify physical support incidents.

Cannot do:No direct writes to infrastructure or endpoint command execution.

Protection:Image-only analysis pipeline with scoped output into workflow decisions.

Examples:Printer panel diagnostics, cable and port checks, hardware triage.

Endpoint Agent

Execution-Agent

Client and user session

Can do:Reads local system state, interacts with the user session, and executes approved desktop steps.

Cannot do:No access to other user profiles, no kernel driver changes, and no access to internal servers.

Protection:Kill switch, visible session consent, and per-action approval.

Examples:Teams reset, printer spooler restart, VPN toggle.

Cowork Agent

Execution-Agent

Isolated browser and legacy execution

Can do:Accesses legacy web UIs, runs isolated browser sessions, and interacts with IoT and printer workflows.

Cannot do:No access to the corporate network, no persistent data storage, and no access to domain controllers.

Protection:Isolated VM, ephemeral sessions, and no inbound traffic.

Examples:MFP address book update, legacy ERP data entry.

Critical Systems Agent

Execution-Agent

Controlled infrastructure actions

Can do:Executes defined actions on sensitive systems, such as AD user creation or password reset.

Cannot do:No free shell access, no software installation, and no system registry modification.

Protection:Predefined script whitelist only, no interactive shell.

Examples:AD user creation, password reset, session management.

Cloud Agent

Execution-Agent

Applications and connectors

Can do:Assigns licenses, sets mailbox permissions, and manages SharePoint sites through approved methods.

Cannot do:No access to user emails, no deletion of root sites, and no changes to global security settings.

Protection:Wrapped Graph API calls with OAuth scopes limited to least privilege.

Examples:Mailbox delegation, license assignment, OneDrive setup.

See all six agents

Governance and security

Controlled autonomy for us means clear approvals, hosting in Germany, and technical boundaries that can be reviewed transparently.

Go to security page

Create M365 user

Risk: High

More approvals

Defined operating modes

Actions run only within defined operating modes and with the approvals that match each scope.

Technically enforced safeguards

Technically enforced: Credentials Engine, least privilege, approvals, audit log and kill switch. Four-eyes principle: a security agent reviews every action, and your team additionally approves critical steps.

Hosted in Germany

Hosting in Germany, a GDPR-compliant operating model, and transparent provider boundaries are documented and reviewable.

Full security model

Credential security, operating model, audit logging, data flow, and the review process live on the security page.

Pricing

What it costs, and what comes back.

One flat fee for the platform, one per device. Agent time included.

See pricing

One third

of the cost for the same work

~€20 per completed task, relative to one hour of IT work

Cost comparison based on typical benchmarks per completed task, relative to one hour of IT work. Not a guarantee.

Frequently asked questions

It acts only with the permissions you grant. Critical steps wait for your OK, every step is recorded in the audit log, and the kill switch stops it immediately.

The nordnung Agent works with operating modes for the Endpoint Agent. Depending on the mode, every action requires approval or just initial approval before work can be carried out autonomously within the permitted scope.

Every API call, parameter, approval signature and system state change is recorded in encrypted logs with integrity verification. This provides a complete audit trail for compliance and troubleshooting.

We operate the platform ourselves in Germany, with a dedicated instance per customer. The AI runs provider-independently in European data centres, GDPR-compliant, with a DPA in place. We discuss dedicated setups individually.

Every customer gets its own instance, fully separated from all others. Your content is not used for training.

We use our Cloud Agent, which interacts exclusively via the Microsoft Graph API and uses least-privilege OAuth scopes.

Our platform is built for German and EU compliance. Visible session consent, kill switch, audit logs, hosting in Germany, and a GDPR-compliant operating model are designed to meet typical works council and compliance requirements.

Next Step

Start with a demo, a live test on your own cases, or a security review

Controlled agent logic, clear boundaries, traceable execution, for IT operations in enterprise environments. nordnung.ai runs in production on more than 1,000 endpoints. At SecureVibe since July 2026.

Hosted in Germany

GDPR-compliant operation

Built from practice

Years of IT management and support experience

Security review Free live test

Autonomous IT operations under full control

nordnung.ai in 100 seconds

Today the AI revolution ends at copy and paste.

Shadow AI is already running.

Standard cases eat senior time.

Uncontrolled AI is the real risk.

Waiting is the most expensive option.

Measured at our first customer, not estimated

Experience controlled autonomy

nordnung Cosmos

Phone Agent

Vision Agent

Endpoint Agent

Cowork Agent

Critical Systems Agent

Cloud Agent

Governance and security

Defined operating modes

Technically enforced safeguards

Hosted in Germany

Full security model

What it costs, and what comes back.

Frequently asked questions

Start with a demo, a live test on your own cases, or a security review