Trust & Data Handling

Last updated: June 2026

We ask security teams to point Nowisor at their ServiceNow estate, so we owe you a precise account of what touches your data and what does not. This page is that account. Where it matters, we lead with the option that keeps your data in your hands.

The paste-driven option: your logs never leave your tenant

Our forensic checks — such as the CVE exposure check — run from a read-only Background Script you run yourself on your instance. You paste its output into the page. For our free checks the verdict is computed in your browser: the pasted log text is never transmitted to us. The detection scripts only read log tables and print a result — they cannot write to, change, or call out from your instance. If you need to generate a dated PDF, only the computed verdict (the conclusion) is sent to render it — never the underlying log lines — and the anonymous path stores nothing.

When you connect an instance (OAuth): read-only by default

• Read-only scope. The connected scanner reads configuration and posture via the ServiceNow Table API. It does not modify your instance as part of scanning.
• The one write path is explicit and opt-in. Creating a remediation ticket (a change request or incident) is the only action that writes to your instance, and it happens only when you click to confirm a server-built request you can see first. Nothing is written silently.
• Credentials are encrypted at rest. OAuth tokens are encrypted with AES-256-GCM before storage, under a key kept separate from the session secret. With OAuth we never receive your ServiceNow username or password. If you connect with basic auth instead, that username and password are stored encrypted the same way and sent only to your instance.
• Account passwords are hashed with scrypt; we never store plaintext passwords.
• You can disconnect at any time, which removes the stored connection and its tokens.

Verification methodology: the baseline pin

Every property name, table reference, and detection script we ship is checked against a version-pinned ServiceNow schema captured from a live Personal Developer Instance — not generated from training data. The current pin is a Zurich Patch 6 PDI: 143 table schemas and 90 verified system properties, distilled from a full 3,585-property sys_properties capture that is archived alongside them.

The pin is deliberately not the newest release. Australia has been GA since May 2026 and our baseline has not moved to it yet, so we name the release we actually tested rather than the newest one. Naming only the current release would imply our verification tracks general availability; it tracks a live instance we can re-query, which is a slower and more defensible thing. Identifiers outside that capture are either verified separately against a live instance and cited, or not shipped.

What we deliberately do not do

• We do not require admin credentials or a password to run a forensic self-check — paste-driven is the default.
• We do not write to your instance except the explicit, confirmed remediation-ticket path above.
• We do not run model-generated logic in the verdict path — exposure verdicts are deterministic from your log signals, not an LLM guess.
• We do not turn an incident determination into a legal conclusion. Regulatory output (NIS2, DORA, GDPR) is decision support, not a “you must report” call.

Hosting & data residency

The application and database are hosted on EU infrastructure (Railway's EU-West region in Amsterdam, with the database on a persistent EU volume). AI answer generation uses a US-hosted AI provider by default. Connected accounts and above can change this: Enhanced data protection sends inference to a separate, dedicated Anthropic workspace key rather than the shared one (US-processed), and EU data residency sends it to an EU-hosted gateway in Frankfurt with the model pinned to an EU cloud region, under a signed GDPR Article 28 DPA. On that EU option we have switched prompt and output logging off at the gateway, so under that DPA it keeps no copy of the request or the response. The model behind it is served by AWS Bedrock in Frankfurt under its own terms, which makes this EU-resident processing with no gateway-side logging rather than end-to-end zero retention. Retention and model-training terms for both are set by our agreements with those providers, not by a setting in this product. What the product itself guarantees is narrower and testable: a request the selected option cannot serve is refused and the credit refunded — it is never re-routed to the standard endpoint. If your organisation has a specific data-residency requirement (for example, EU-only processing for NIS2 or DORA), contact us before connecting an instance so we can confirm the right option for your case.

Trust artifacts

We are a small, focused vendor. Formal attestations (SOC 2, an independent penetration-test letter for the app and OAuth flow) are on our roadmap and prioritised by real enterprise demand. If your procurement process needs one of these to proceed, tell us — and in the meantime, the paste-driven path above lets you get value without connecting anything at all.

Contact

Questions about data handling, a security questionnaire, or a residency requirement? Reach us via the main site and we will respond directly.