Security

Security is foundational to Norn. Because we work with sensitive financial data, we built the Service around a simple principle: Norn can read to help you, but never touch your money. This page summarizes the practices that protect your accounts and data. For the legally binding version, see the Security statement.

Read-only, always

Norn connects to your brokerage accounts using read-only permissions provided by our aggregation partner, SnapTrade. Norn does not — and cannot — place trades, transfer funds, or otherwise move your assets. Your assets remain in the custody of your brokerage at all times.

• We never request trade or transfer scopes during the brokerage OAuth flow.
• Even a fully compromised Norn couldn't move your money — the permission simply doesn't exist.

Credentials never touch Norn

When you connect a brokerage:

• The login form is served by SnapTrade, not Norn.
• Your credentials are transmitted directly to SnapTrade's authentication flow, which passes them to your broker's OAuth endpoint.
• Norn only ever receives a short-lived access token scoped to read permissions.

We do not store, log, or have any ability to retrieve your brokerage passwords.

Encryption

• In transit: All data — API traffic, MCP calls, browser sessions — is encrypted with TLS 1.2+ using modern cipher suites.
• At rest: Access tokens, personal information, and portfolio data are encrypted at rest using AES-256 with keys managed by our cloud provider's KMS.

Access controls

• Norn engineers cannot access customer financial data except through auditable, time-limited elevation for incident response.
• All production access is behind SSO with MFA required.
• Least-privilege IAM policies are enforced across all backend services.

Data retention & deletion

• Disconnecting an account immediately revokes Norn's access token. Cached position, transaction, and performance data is deleted or de-identified within a commercially reasonable period.
• Closing your account deletes or de-identifies all associated data, subject to retention required by law.
• You can also revoke Norn's access from your brokerage's own permissions screen at any time.

AI processing

Norn uses AI models to analyze your holdings and generate research. Where third-party AI providers are used to process data on our behalf, they are bound by contractual obligations that restrict use of your data to providing the service to us.

MCP server

The MCP server inherits the same read-only model:

• Read tools call Norn's internal APIs with your organization scope; they cannot escape it.
• Write tools are strictly limited to saved portfolios (Norn-only state). No write tool touches your brokerage.
• The MCP client's memory, chat, and files are never read by Norn.

Responsible disclosure

Found a security issue? Email security@nornhq.com. We respond within one business day and coordinate disclosure timelines with reporters in good faith.

Learn more

• Privacy Policy — what we collect and how we use it.
• User Agreement — the full terms of service.
• Trust Center — the legally binding security statement.