Security at Northset
Built to be trusted
Northset connects to the tools your team relies on. Every connection is encrypted, isolated to your organization, and read-only wherever the tool allows.
How Northset Connects
Read-only by default.
Northset asks for read-only access wherever a tool offers it, so your code, tickets, documents, and calendars stay exactly as your team left them. The only thing Northset writes is the alerts it sends where your team works.
Conversations with clear limits.
In chat tools, Northset reads public channels, and private channels you add it to, to find commitments. Direct messages stay private and are never read.
Full transparency on data.
Our Data access page lists every tool we connect to, what we read from each, what we store, and for how long.
Technical Security
Encrypted in transit.
All traffic to and from Northset is protected with HTTPS and TLS.
Encrypted credentials.
Every stored credential for a connected tool is encrypted with AES-256-GCM, and kept out of code, logs, and version control.
Isolated by organization.
Each organization's data and credentials are walled off from every other customer, and the database itself enforces it.
Tested on every change.
Our test suite runs on every pull request, including tests that enforce these security rules.
Monitored hosting.
Northset runs on Render in the United States, with data stored in PostgreSQL and uptime monitoring that alerts our team.
Access through tools you already control.
Admins connect Northset through each tool's own approval screen, so access follows the permissions you already manage. There are no separate Northset passwords.
AI and Your Data
Northset uses Anthropic to analyze messages and write alerts. Anthropic is contractually prohibited from training on your data, and deletes what we send it within 30 days, except where it must keep data longer to enforce its usage policy or to comply with the law. Northset does not train AI models on your data either.
Your Data, Your Control
Clear retention limits.
Workspace data is kept while your organization is connected, with shorter limits for some kinds of data. Full details are in our Privacy Policy.
Deletion on request.
Email privacy@northsetapp.com to delete your organization's data. We complete verified requests within 30 days and confirm by email.
Named subprocessors.
We share only what's needed to run the service, with the subprocessors listed in our Privacy Policy. Customer data is never sold.
Request Documentation
Need documentation for a security review? Email us and we'll follow up.
Send Request