Where we are. Where the data sits. Who has access.

Classifier runs in-browser

The Northbeams browser extension classifies every prompt locally. The prompt text itself never leaves the user's device. Only category labels, redacted snippets, and policy events are sent to the dashboard.

MCP arguments stay on-device

The MCP Gateway is a local stdio proxy. It classifies every MCP tool argument on the user's laptop and sends only categorical labels (credentials, PII, source code, legal terms, customer data) and a sha256 hash to the dashboard. The argument values themselves never leave the device.

No proxy. No MITM.

Northbeams does not intercept network traffic. There is no proxy, no TLS-stripping certificate, and no on-prem appliance. There is nothing in the network path that could be a single point of failure or a privileged target.

Heavy AI-detection agents sit in your network path: a proxy, a TLS-stripping cert, an appliance to babysit. Northbeams classifies on-device and changes nothing about your network.

Encrypted at rest and in transit

All metadata in the dashboard is encrypted in transit (TLS 1.3) and at rest. Customer data is logically isolated per tenant. Audit logs are immutable on Sentinel and Fleet.

Sub-processors

The current list of every third-party service that processes customer data lives at /sub-processors, with purpose, region, and certifications per vendor. We notify subscribed customers at least 30 days before changes.

Data residency

US-region by default. EU-region available on Fleet. We do not move customer data between regions.

Retention

Default audit-log retention varies by tier (90 days on Lighthouse, 1 year on Sentinel, 7 years on Fleet). Customers can configure shorter retention to meet local data minimisation requirements.

What happens to your data if Northbeams shuts down?

Your data is yours. If we ever wind down the service, we will send every workspace owner a 90-day advance notice with a full JSON export of their audit logs, tool inventory, policies, and user records. Exports are also available on demand at any time from the Settings page. We will not delete your data until you have confirmed receipt of the export or the 90-day window expires, whichever comes later.

Cancellation and deletion

Cancel from the in-app billing portal at any time. You keep paid features through the end of your billing period. After full cancellation, we soft-delete the workspace immediately with a 30-day undo window, then hard-delete every record across Firestore + Storage. An immutable deletion log is retained for the legal-floor period.

Auditor-ready Evidence Packs

Workspaces can generate signed PDF Evidence Packs covering EU AI Act, ISO/IEC 42001:2023, NIST AI RMF, and SOC 2 readiness controls. Every pack carries an HMAC-SHA256 signature backed by a per-org key; auditors verify externally at /trust/verify. The underlying audit log is append-only and hash-chained, and a daily verifier walks the chain end-to-end.

DPA, BAA, and SCCs

Standard DPA covers GDPR Article 28, the UK GDPR, the 2021 EU SCCs (Module 2), and the UK IDTA. Counter-signed within one business day. HIPAA BAA available on the Fleet tier. See /dpa.