Security isn’t a layer we add on. It’s the foundation we build on.

Nostrion builds independent AI for regulated markets. Security, privacy and sovereignty are built into every layer from the first design decision, not added afterwards.

Visit the Trust Center

Four principles, one foundation.

For every part of our platform we ask four questions. Is it secure? Is it private? Does control stay with the client? Can we prove it? Not a checklist applied afterwards, but the starting point for every architectural decision.

  1. 01

    Security by design

    Every client works in their own separated environment, their sovereign vault. Client environments, IP and sensitive data never mix, and access follows least privilege.

  2. 02

    Privacy by design

    Data minimisation and purpose limitation are built into the platform. Lessons travel, data stays: we share what we learn, but your data never trains or improves any model, not for you and not for other clients.

  3. 03

    Sovereignty by design

    Every layer that touches your data, from the CDN to the model, is EU-hosted, EU-owned and governed by EU law. Your knowledge, and the intelligence built on it, stays yours.

  4. 04

    Proof by design

    Trust should be verifiable: independent audits for ISO 27001, ISO 42001 and NEN 7510, automated security testing during development, and continuous penetration testing that we are now putting in place.

Data sovereignty: more than “in Europe”.

Sovereignty by design means more than a server location on a map. For every layer that touches your data, we ask where it is processed, who the supplier is, and under whose law that supplier falls.

The answer has to be European. From the CDN that handles every request to the model that processes it, every layer is EU-hosted and EU-owned, with our AI infrastructure built together with European partners such as Nebul. No exceptions, no middle ground: a supplier that doesn’t meet that requirement doesn’t enter the chain.

European jurisdiction

Your data
Content deliveryEU-hosted · EU-owned
HostingEU-hosted · EU-owned
AI infrastructureEU-hosted · EU-owned
Model processingEU-hosted · EU-owned
Your sovereign vaultIsolated per client
Fully governed by EU law
The chain that processes your data runs on a small number of carefully selected suppliers, all of them European. No US cloud provider or hyperscaler ever processes your data, so extraterritorial claims such as the US CLOUD Act have no hold on it.
Open-weight by choice
We build on open-weight models by choice, so no closed model vendor can lock you in. Every model we use runs on European infrastructure, and your data never goes to the model’s developer.
A chain we keep assessing
Every supplier is assessed upfront on security, privacy and jurisdiction, and periodically reassessed after that, including on data sovereignty. An ongoing safeguard, not a one-time snapshot.
You are, and remain, the owner of your data
Nostrion processes your data solely to deliver the agreed service, never for our own purposes. If you end our collaboration, we delete your data: it remains yours, not ours.

People, process and technology. For your organisation, and for ours.

When you work with Nostrion, the people-process-technology triangle shows up concretely in your daily practice. We apply the same triangle to ourselves: for us, security, privacy and sovereignty aren’t product features, they’re a way of organising.

For your organisationInside Nostrion

People

For your organisationYour domain experts, whether notary, accountant, administrative staff member or compliance officer, always retain final control. The platform supports and accelerates, but professional responsibility stays where it belongs: with your people.

Inside NostrionNostrion employees have no access to client data within the platform. Employees are screened and continuously trained in information security and the responsible use of AI.

Process

For your organisationRecurring work becomes faster, more consistent and fully traceable. AI takes on the volume, so your people can focus on quality: the work itself and your own clients. Your quality and compliance processes stay leading; the platform fits around them rather than replacing them.

Inside NostrionOur governance runs on certified management systems for information security and AI, and for the notarial sector it is set up in line with the GIN. Incident response, change management and periodic risk assessments are standing parts of how we operate, and we’re transparent about it.

Technology

For your organisationYour data and IP demonstrably remain under your own control, so your organisation can adopt AI without trading away the duty of care your profession demands.

Inside NostrionThe access controls and monitoring that protect your vault also protect our own internal systems. Automated vulnerability testing is part of how we build software, from development to production.

How we protect your data.

Our principles and governance take concrete shape in the day-to-day protection of your data. These are the measures that make the difference.

Encryption
Data is exchanged over encrypted connections and protected with encryption within our platform.
Confidentiality by default
All client data is treated as confidential, regardless of its nature or content. Confidentiality is the starting point, not a separate assessment per file.
Strict access security
Access is personal, secured with multi-factor authentication and set up on a least-privilege basis. We do not allow shared accounts.
Logging and monitoring
Logins, failed attempts and security-relevant changes are logged and monitored, so anomalies are flagged quickly and security-relevant events stay traceable.
Notify and recover
If an incident affects your data, we will, as a rule, inform you within 24 hours about its nature, impact and the measures taken. For larger disruptions we maintain a business continuity plan and a disaster recovery plan, and we test our continuity measures periodically.
Fixed retention and deletion periods
Fixed retention periods apply to every data category. After the agreement ends, we delete your personal data, as a rule, within one month.

Assessed against the frameworks that matter.

We don’t get assessed to display a badge. We do it because it enforces the discipline our clients need.

Our certifications cover our entire business operations, not just the product. Full standard references: NEN-EN-ISO/IEC 27001:2023/A1:2024 nl, NEN 7510-1:2024 nl, NEN-EN-ISO/IEC 42001:2026.

Trust Center

Want to view certificates, policy documents and audit reports?

Visit the Trust Center

Have questions?

Schedule a conversation with our Chief Compliance Officer.

Pascal SchipperheynChief Compliance Officer