Security

Your quality records are evidence. This page says plainly how Norma protects them — and what Norma is not.

Your data is walled off from everyone else's

Every customer's records sit in the same database, separated by Postgres row-level security: every table carries a policy that admits only the organization the request belongs to. The application connects as a database role that cannot see past that wall, and automated tests check on every release that every table has it.

Hosting and encryption

• Norma runs on Supabase (database, sign-in and file storage) in the United States, in AWS's us-east-2 (Ohio) region, and on Vercel (the apps). See Subprocessors.
• All traffic is HTTPS. Browsers are told never to connect to Norma without it, and Norma's pages can't be framed by other sites.
• Data is encrypted at rest by our database provider.

Signing in

• Passwords are held by our sign-in provider as one-way hashes; Norma never sees them.
• Administrators confirm a second step with an authenticator app before administrator actions. Anyone else can turn it on for their own sign-in.
• After 15 minutes without activity, the server signs the session out, whatever the browser does.
• Changing a password needs the current one (or a fresh emailed link), and signs out every other session.
• Repeated wrong codes lock the account for an hour.

Signatures and the record

• Approving a document revision, approving a scope, releasing a NormaMES router, and acknowledging or responding in the supplier portal each ask the signer to re-enter their password. The signature records the signer's name, the date and time, and what it means.
• Every recorded action goes on an append-only record chain. The database itself refuses to change or delete it.
• Every stored file is checked against its SHA-256 fingerprint when it's read back, so a changed file is caught, not served.

Uploads

Files are checked before they're stored: only allowed file types (PDF, common images, text and CSV, and Word, Excel and PowerPoint files), and the file's contents must match its type. Web pages, scripts, SVG images, programs and macro-enabled Office files are refused, as are files containing script markup and the standard anti-virus test file. Norma does not run a full anti-virus scan. Files are limited to 25 MB.

Backups

Our database provider takes a daily backup and keeps each backup for 7 days. Point-in-time recovery is not enabled. You can download your own complete copy at any time: Settings → Termination pack gives you your registers, files and record chains, with a manifest you can verify.

Monitoring

Norma records its own server errors and browser security reports in its own database. No third-party error tracker or analytics service sees your data.

What Norma is not

We'd rather you hear it from us:

• Norma is not for Controlled Unclassified Information (CUI), ITAR technical data or other export-controlled technical data. Don't upload it. NormaECS stores a reference, a status and a sign-off — never the controlled material itself — and Norma refuses drawings on a part revision marked as controlled.
• Norma is not FedRAMP authorized and isn't a CMMC Level 2 enclave.
• We don't have a SOC 2 report yet. We're glad to answer your security questionnaire.

Reporting a problem

If you think you've found a security issue, email support@normaqms.com with "Security" in the subject. We'll answer quickly and won't take action against good-faith research that avoids other customers' data.