Watch Tower - Applied Intelligence for your Business · Trust
Trust at Watch Tower
How we handle personal information and the business data customers share with us, in plain English. These pages describe the controls built into the Watch Tower Console today. They are product controls, not a certification.
Last updated: 9 October 2026
At a glance
How the Console protects customer data
- You control your dataThe customer is the controller. We act on its written instructions as processor and data architect.
- One tenant per customerPostgres row-level security and Purpose-based access keep every customer's records apart.
- Access that expiresEvery read happens under a Purpose. Grants need a reason, cannot be self-approved and expire.
- An audit log nobody can editAppend-only for every role. Reads are logged by dataset, and AI calls without their prompts.
- Real data only after approvalThe Console holds fictional demo data today. Real records are refused until a processing register is approved.
- No data brokeringWe never sell customer data or move it between customers. We say de-identified, never anonymous.
Policies
Read the documents
privacyPrivacy PolicyWhat personal information we collect through our website, the Console and sales conversations, why, who we share it with, and your rights.Read the privacy policy →securitySecurity OverviewHow the Watch Tower Console protects customer data, what we do not claim yet, and how to report a vulnerability.Read the security overview →data governanceData GovernanceYou are the controller and we are your data architect: minimization, markings, retention, deletion, legal hold and AI data controls.Read the data governance →acceptable useAcceptable Use PolicyThe rules for everyone who uses the Watch Tower Console.Read the acceptable use policy →termsTerms of ServiceThe terms for using Watch Tower, Beacon and Forge and buying from us online: accounts, prices, payment, cancellation and our responsibilities.Read the terms of service →refund policyRefund and Cancellation PolicyAll purchases are final and non-refundable. How you pay (Razorpay in INR in India; PayPal or Razorpay in USD elsewhere), how to stop at any time, and what we do about billing errors.Read the refund and cancellation policy →shipping policyShipping and Delivery PolicyEverything we sell is digital: nothing is shipped, and your purchase is delivered instantly online, in your account.Read the shipping and delivery policy →
For customersData Processing AddendumA DPA template naming the customer as controller and Speedloop Auto Private Limited as processor, with our security measures and subprocessor list. Available on request: write to customers@norventus.com.
What we do not claim yet. We have no SOC 2 report, ISO 27001 certificate or third-party penetration test, no uptime commitment and no backup or restore guarantee. A full restore test and an independent security review are planned. See the Security Overview.
Found a security issue? Email customers@norventus.com with the subject "Security report". Our reporting guidelines explain what to include.