Create M365 user
Risk: HighWorkflow · Employee onboarding
Governance is part of the product core.
Controlled autonomy means clear approvals, technical boundaries, and verifiability in a security review.
Security
What sets us apart
At nordnung.ai, security is not an add-on but the blueprint: from the platform down to every single click on a device.
Built on BSI IT-Grundschutz++
Our ISMS follows the BSI's new IT-Grundschutz++. Roles, processes and evidence are structured accordingly.
ISO 27001 in preparation
We are building an ISMS under ISO/IEC 27001. The certification audit is planned for the first half of 2027.
KRITIS-compliant
Built for operators of critical infrastructure: approval before every critical step, a complete audit log, platform in Germany and, for regulated customers, their own key (BYOK) with mandatory two-factor authentication.
NIS2-compliant
Every action is logged, every approval traceable. You document risk management and evidence under Section 30 BSIG straight from operations.
GDPR-compliant
Data processing agreement under Art. 28 GDPR including TOMs. AI runs provider-independently in European data centres.
Made in Germany
Developed by nordnung GmbH in Hamburg. The platform is self-hosted in Germany.
Tenant isolation
Every customer gets a dedicated instance. Data, access and logs stay separate.
Audit log and kill switch
Every step is recorded in the audit log. The kill switch stops any session instantly.
nordnung.ai · audit.log
> session start: ticket #4821
instance isolation verified ✓
AUDIT: dedicated instance · data center DE
> request credential: exchange
vault injection to approved asset ✓
POLICY: passwords are not passed to the AI model
> execute action: mailbox permission
security agent: four-eyes check passed ✓
approved by admin@customer.com ✓
AUDIT: signature + method call recorded
> kill switch available
session can be stopped anytime ✓
Nine commitments, all verifiable.
Every commitment is backed: in the audit log, in the DPA or in the security review.
- ✓Hosted in GermanyDedicated instance per customer
- ✓Instance isolationData & execution separated
- ✓Credentials in VaultAES-256, approved assets
- ✓Passwords never reach the AI modelCredentials engine injects them directly
- ✓Four-eyes principleA security agent reviews every action, and your team additionally approves critical steps
- ✓Audit logIntegrity-checked, per step
- ✓Kill switchStops instantly
- ✓AI provider-independentIn European data centres
- ✓DPA & security reviewReview on request
Approvals before anything happens
Every pending action lands in one inbox, sorted by risk. In operating mode 1, no step runs before an admin has approved it.
Try it: approve or reject, just like in the platform.
At our first customer, an IT service provider, 81% is automated, as of October 2026. The decision when that happens stays with a human.
nordnung.ai · approvals-inboxSchematic view · German product UI · demo data
Pending approvals (3)
Run diagnostic script on workstation
Risk: MediumDevice · FIN-PC-04
Read SharePoint list
Risk: LowWorkflow · License overview
Autonomy is deliberately staged
It grows with the IT team's trust: from the first approval to solving on its own.
Operating mode 1
A tool for IT. The team operates nordnung; every relevant action requires approval.
Operating mode 2
nordnung acts on its own, but with tight approvals in a defined user context.
Operating mode 3
nordnung answers calls, resolves on its own, and escalates when needed.
Data flow and providers
Intake, controlled execution, and feedback are separate paths. Not every piece of information reaches every path.
Least privilege per agent, scope, and endpoint.
Audit and operational data retained only as long as needed for traceability and support. Details in DPA and review.
Goal: maximum independence from external providers; open-source principles as the strategic core.
For regulated customers: your own key (BYOK) and mandatory two-factor authentication.