Architecture
How the NeuroStrike platform is hosted, where your data lives, and how AI stays sovereign.
This page covers what matters for a security review: where the platform runs, where your data lives, what crosses the network boundary, and how AI inference stays in-country. It describes the platform and its trust boundary, not the internal testing engine.
Hosting & data residency
Production runs on infrastructure operated by Eltele AS in Alta, Norway (EEA), at an ISO 27001-certified facility (the certification belongs to the hosting provider). All customer data — targets, findings, and reports — is stored in Norway / the EEA. Only a single public web tier is reachable from the internet; the database and processing run on a private, encrypted network with no public ports.
Data flow & trust boundary
By default, your scan data and AI inference stay in the EEA. An organization can request cross-border commercial models (Anthropic Claude or Google Gemini, USA, under Standard Contractual Clauses). NeuroStrike never uses OpenAI/GPT.
A small amount of operational data is handled by sub-processors outside the EEA under Standard Contractual Clauses — transactional email (Resend) and application error monitoring (Sentry). The full list is in the sub-processor register of our Data Processing Agreement.
Sovereign AI by default
By default, all AI inference runs in Norway on open-weight large language models hosted on the Telenor AI Factory (Telenor ASA, a sub-processor). The platform enforces this per organization: a sovereign organization's Strikes can only select in-country models, so no scan data is sent to a model provider outside the EEA. Organizations that prefer the commercial frontier models can have them enabled on request.
| Tier | Models | When |
|---|---|---|
| Default — sovereign | Open-weight models on Telenor AI Factory (Norway) | Always on unless changed for your organization |
| Optional | Anthropic Claude | Enabled per organization, on request |
| Optional | Google Gemini | Enabled per organization, on request |
Data protection
- Encryption in transit — all public connections use HTTPS (TLS 1.2 or later) with HSTS.
- Encryption at rest — sensitive fields are encrypted with AES-256-GCM.
- Tenant isolation — strict per-organization data isolation across the platform.
- Secret redaction — credentials and secrets are redacted before they are stored or exported.
See Security & Trust for the full security policy, and the On-Prem Agent guide for fully self-hosted or air-gapped deployments.