Normos

Normos connects to your GitHub organisation via read-only OAuth and runs 21 deterministic detectors every night at 02:00 UTC across five domains — Identity, Code, Non-Human Identity, Access Control, and Supply Chain. No manual uploads, no screenshots. You wake up to a scan completion email with your Normos Readiness Score.

No. Normos connects read-only, analyses everything in memory, and stores only the findings — never source code, commit history, user lists, or business data. Even in a breach, there is nothing sensitive to lose, because nothing sensitive was ever kept.

Each scan record is hashed and linked to the one before it, making the evidence tamper-evident — any change to a past record invalidates every hash after it. Auditors can independently verify the integrity of the entire evidence history.

A weighted readiness metric combining deterministic scan evidence (60%) and signed management assertion coverage (40%) into a single, defensible number from 0 to 100 — available on every plan.

Yes. Detectors like Review Collusion Risk (closed-loop PR review patterns), Machine Credential Sprawl (deploy keys, OAuth installs), and CI/CD Workflow Security (fork PR injection, wildcard permissions) surface findings that are statistically invisible to a human auditor and are not checked by questionnaire-based tools.

Most customers produce their first cryptographically chained evidence package within 24 hours of connecting GitHub. OAuth setup takes under 10 minutes; the first scan runs that night.

A board-ready PDF generated automatically after every scan, summarising your Normos Readiness Score, verified controls, active management assertions, and the forensic hash chain reference — not a certification, but forensic proof of current posture.

Four read-only OAuth scopes: read:user, read:org, repo, and admin:org (used solely to identify members without MFA enabled). No write access is requested or used at any point.

Normos is ICO-registered (ZC158944) and processes only the minimum data necessary — findings, scan metadata, and account information — stored in Supabase EU Ireland.

All data is permanently deleted within 30 days of account closure, with written confirmation. You can export your evidence package and Assurance Letter at any time beforehand.

ISO 27001:2022 and SOC 2 today, both included in every plan at no extra cost. Cyber Essentials, CE+, DORA, and AI-aware detection are planned for Phase 2, followed by NIS2, SOC 2 Type II, and PCI DSS v4 in later phases.

The two frameworks share roughly 80% of the same controls, and Normos generates both evidence packages from the same scan — charging twice for the same data would be a tax on compliance, not a service.

Assertions are cryptographically hashed statements confirming controls that can’t be detected automatically — policies, background screening, physical access. Each is SHA-256 hashed, requires AAL2 MFA, and expires after 12 months.

AuditChain is Normos’s forensic evidence portal for external auditors — token-gated, OTP-verified, read-only access at audit.normos.io. All plans include the Readiness Score, findings list, evidence PDF, and hash chain; Enterprise adds control-to-finding mapping, trend charts, and framework filtering. Tokens expire after 7 days and can be revoked instantly.

Auditors are increasingly sceptical of screenshot-based evidence, which can be fabricated or selectively curated. Normos evidence is produced by a deterministic rule every time, hashed at the moment of detection, and independently verifiable through a dedicated auditor portal — not a shared login to your internal dashboard.

Yes. Normos handles continuous technical evidence generation automatically, freeing your consultant to focus on policy, risk assessment, and audit preparation rather than manually collecting screenshots.

Starter is £9,600/year, Enterprise is £24,000+/year, both billed annually in GBP with full ISO 27001 and SOC 2 coverage and no per-framework upcharges. Both plans include a 30-day value guarantee.

Vanta and Drata automate questionnaires and collect evidence via screenshots and integrations. Normos generates forensic evidence instead — deterministically produced, SHA-256 hashed, and tamper-evident — and includes ISO 27001 and SOC 2 in every plan rather than charging per framework.

Yes. Normos is built for engineering-led SaaS companies roughly 10–200 employees, whether pursuing ISO 27001 or SOC 2 for the first time, or already certified and needing continuous evidence between audits. Setup takes under 10 minutes via GitHub OAuth.

Normos is GRC Platforms. Normos offers the following functionalities:

• Internal Controls Management
• Reporting & Analytics
• Audit Management
• Risk Management
• Compliance Management

Learn more about Normos features.

Here`s a list of the best alternatives for Normos:

• Compyl
• AuditBoard
• 6clicks
• GRC Toolbox
• AdaptiveGRC

No, Normos does not provide API.