Security

norc doesn't hold SSH keys or SSH into your machines

There's no inbound access. You install a small agent on each machine you pair (the desktop app or the headless norc CLI daemon), and that agent makes an outbound-only connection to norc's relay — the same direction your browser talks to a website. Nobody connects in.

Every write that agent applies is authorized by a short-lived, single-use capability: a signed token (ES256 JWT) minted server-side, scoped to that one machine, that one job set, and a monotonic generation counter. The agent independently verifies the signature, audience, expiry, machine id, and a nonce before it touches anything — a replayed or forged token is rejected even if our servers were compromised. On desktop, every write also requires a native Yes/No dialog the first time (sticky per machine after you approve it); on a headless server there's no one to prompt, so pairing itself is treated as standing consent — the same tradeoff you make installing any unattended agent.

Revoke access anytime from the vault's Machines page — Unpair immediately stops the agent from accepting further writes.

norc only ever touches the lines it wrote

Every job norc manages gets a tagged comment line (# norc: <id> <name>) directly above its crontab entry. Reconciliation matches strictly by that id: entries you wrote by hand, or that predate norc, show up as "unmanaged" and are left alone — norc will never silently edit or delete a line it didn't tag. Before any write is applied, it's round-tripped and re-parsed to confirm it produces exactly the intended set of tagged lines, with no injected or forged entries, control characters, or oversized fields.

You can verify this yourself, independent of the app: run norc jobs list on a paired machine to see exactly what norc thinks it owns, or just crontab -l before and after pairing to see the tagged lines norc adds. Nothing else in your crontab changes.

If norc goes down, your jobs keep running

Cron on your machine is what actually runs your jobs, on its own schedule, using its own local crontab — norc's cloud is a control plane that reads, writes, and syncs that crontab, not an execution engine in the loop. If norc's relay or web app is unreachable, jobs already written to a machine's crontab keep firing exactly as scheduled; you just can't view or edit them from norc until the connection comes back. There's no SLA or uptime guarantee on norc's cloud services today (see Terms), but that's specifically because your jobs don't depend on it. Hosted schedulers that run jobs on their own servers can't say the same — see the comparison.

What norc encrypts, and what it doesn't

Your account password is hashed via Supabase Auth, never stored in plaintext. If you enable two-factor authentication, your TOTP secret is stored server-side (not end-to-end encrypted). If you bring your own key to AI Studio, that key is encrypted at rest with AES-GCM before storage. Job and machine data — schedules, commands, machine names, run status — is stored as-is in Supabase's Postgres, protected by row-level security scoped to your account, not client-side encrypted. If your cron commands themselves contain secrets, treat norc's database the way you'd treat any other place those commands are readable, including your own crontab today.

norc is not end-to-end encrypted. If that's a requirement for your threat model, don't put anything in a scheduled command you wouldn't want stored server-side.

Where your data lives, and who touches it

Supabase hosts the database, auth, and realtime relay infrastructure. Stripe processes billing — norc never sees or stores your card number. If you use AI Studio with your own key, your prompts go to the AI provider you chose (e.g. OpenAI, Anthropic), under that provider's terms, not norc's. That's the complete list of subprocessors; no ad networks, no data brokers, no third-party analytics inside the desktop, mobile, or vault apps. Full detail in the Privacy Policy.

Your account, job, and machine data is hosted on Supabase infrastructure inside the EU (eu-west-3, Paris), with authentication in eu-west-1, Ireland — it doesn't leave the EU by default. Being EU-hosted means norc's processing of that data falls under the GDPR; we haven't published a Data Processing Agreement or completed a full compliance audit yet, so if either is a hard requirement for your organization, email hello@norc.app before you rely on it.

Self-hosted mode

Not available today. norc's cloud (Supabase-backed relay, auth, and sync) is the only way to run it. If self-hosting the relay is a blocker for you, tell us at hello@norc.app — it's not built, and we'd rather know it's needed than guess.

Open source

norc's codebase is private today, not open source. There's no public repo to audit independently yet. The mechanisms on this page (managed-line tagging, capability signing, the consent gate) are the honest description of what the code does, but you currently have to take our word for it rather than read it yourself.

Questions

Email hello@norc.app with anything this page doesn't answer.