Data Handling & Privacy

Zero-Data-Retention

noris operates a strict zero-data-retention policy:

• Prompts and completions are not persisted.
• Content is never used for training or fine-tuning models.
• Requests are discarded immediately after the response is delivered.

This policy applies without exception to all endpoints and models. Only aggregated, anonymized metadata (e.g. token counters for AI-Punkte billing) is collected, never the content of requests.

GDPR Compliance

All data processing takes place in Germany. Data never leaves the EU or Germany at any point. This ensures noris meets GDPR requirements regarding data localization and sovereignty.

Data Center Security

The platform runs in highly secure noris data centers in Germany. This includes:

• Physical security: access controls, video surveillance, security personnel
• Fire protection: early fire detection and suppression systems
• Fail-safe power supply: redundant UPS systems and diesel generators
• Climate control: continuous temperature and humidity regulation

Open-Weights Models

All deployed models are open-weights models. This means:

• No telemetry: the models send no usage data to third parties
• No phone-home: no automatic callbacks to manufacturers
• No hidden data channels: full transparency of the model architecture

Shared Infrastructure

The infrastructure is shared across multiple customers. Isolation is achieved through:

• Logical tenant separation at the API level, every customer receives isolated credentials
• Stateless processing: requests carry no state between tenants
• Isolated memory: the KV cache is released immediately once a request completes