Residency
Hosting location and authorised flows are recorded in the project scope.
Your data stays within a defined boundary.
Residency, access, processing, return terms and production conditions are agreed before a source is connected.
Explicit responsibilities at every stage.
KER structures controls around roles and the decision journey. Institution requirements complete that foundation during scoping.
Access
Each profile receives the information and actions required for its role.
Separation
Investigation, oversight and administration follow distinct responsibilities.
Traceability
Sign ins, changes, decisions and sensitive operations feed the audit trail.
Return
Formats, timelines, retention and deletion are defined before production.
Reuse
Any use of data or results outside scope requires written approval.
The data journey is decided before the pilot.
Define
Select the case, sources, fields and duration required.
Connect
Authorise only planned flows into the agreed environment.
Operate
Calculate signals, create cases and apply role based rights.
Control
Track decisions, approvals, exports and policy changes.
Return
Provide agreed elements, then apply retention and deletion rules.
Deployment fitted to the institution’s framework.
The choice depends on required residency, expected operations and contractual responsibilities.
On premises
KER is assessed within infrastructure controlled by the institution.
Private cloud
The environment is isolated within an agreed cloud boundary.
Hybrid
Sensitive data and services are distributed according to approved constraints.
Evaluate the journey without exposing customer data.
The demonstration environment uses synthetic data and a simulated model. It is built separately from production mode and verifies that mode before starting.
Isolation
Sandbox mode has its own build configuration.
Bilateral guardrail
A simulated artefact is rejected outside the sandbox and a real artefact is rejected inside it.
Published access
The Sign in button appears on the site when the deployed environment URL is provided.
Scoped exit
The end of testing, return terms and any production move are agreed in advance.
Current status and expected checks.
A demonstration is neither a security approval nor a production validation. Each deployment requires a documented review.
Certifications
Noysau does not currently claim ISO 27001 certification or a SOC 2 report.
Assessment
Architecture, dependencies, access, backups and continuity are reviewed before production.
Commitments
Selected guarantees are recorded in contractual documents and acceptance criteria.
Review security within your scope.
Share residency, access and operating constraints before the demonstration.