Runs inside your perimeter · zero external requests
Noveam maps the systems, interfaces, infrastructure and business functions you actually run. Your NIS2 and DORA coverage is computed from that same model, on request, clause by clause. Where the model cannot evidence a measure, the screen stays blank.
Runs air-gappedNIS2 & DORAYour database, your disk
GET/governance/nis2
NIS2 Art. 21(2) — coverage
Risk analysis and information system security policies
Incident handling
Business continuity and disaster recovery
Supply chain security
Security in acquisition, development and maintenance
Assessing effectiveness of risk-management measures
Basic cyber hygiene and security training
Cryptography and encryption
Human resources security and access control
Multi-factor authentication and secure communications
Six of these ten measures have no rule behind them in Noveam. The view says so. It does not average them away, and it does not colour them green.
35 checks0
Requests to a vendor endpoint. No CDN, no telemetry, no analytics. The only outbound call the product makes is to your own identity provider.
35
Consistency checks, recomputed on every request. Nothing is stored between runs, so nothing can go stale.
15
Register of Information templates, all emitted in ITS order — including the ones your model cannot fill. Those come out empty, with a note.
1 file
One SQLite database per tenant, on your disk. Back it up by copying it. There is no external database to operate.
01 Capabilities
Every claim on this page is something that ships today. Nothing here is a plan wearing a present tense.
Systems and their releases, interfaces, technical components, infrastructure, business processes and the units that own them. One model, one vocabulary, every relationship navigable in both directions — down to the clusters, namespaces, workloads and certificates you actually operate.
Five diagram views are drawn by the server and arrive as finished pictures. No client-side rendering engine, no browser plugin, nothing to install on an analyst’s machine — which is exactly why they still work on a host with no route to the internet.
NIS2 and DORA coverage is computed from the model on request, clause by clause. The DORA Register of Information is assembled from the same model and exported across all fifteen ITS templates, as a draft your entity reviews and owns.
A measure with no rule behind it is drawn hollow and labelled Not modeled. Never quietly green, never inferred, never rounded up. What your model states and what a scanner reported are kept on two separate axes, because they are two separate claims.
02 Inside the product
Dense where density earns its keep, quiet everywhere else. Light and dark, both first-class.
03 Governance
Compliance coverage here is not a questionnaire you fill in. It is derived from the landscape you have already modelled, so it moves when the landscape moves and it cannot drift away from it.
Your architecture states the control exists. The redundancy is drawn, the encryption attribute is set, the interdependency is recorded. This is intent, evidenced by structure.
A scanner reported on the running estate and its report was imported. Noveam records what the scanner said and names it. It is allowed to disagree with the model.
Drawn hollow, labelled Not modeled, counted as a gap. Organisational measures — training, incident procedure, board accountability — live here by design. A model can reference them. It can never evidence them.
Evidence is modeled, not verified. Every coverage view carries that sentence. Overstating coverage is the one failure an architecture tool must not have, because the architect is the one holding it when the question comes.
Contractual arrangements, ICT third-party providers, the services they deliver and the functions those services support — kept in the same model as everything else, exported across all fifteen ITS templates.
Every worksheet, every CSV and every filename carries DRAFT — modeled, not a certified filing. Noveam produces the draft. Your entity reviews it, completes it and submits it.
04 Deployment
Same product, same model, same code. Only the perimeter changes.
One process, one port, on a host you own. Put it in a segregated zone, or on a network with no route out, and it behaves the same — because it never needed the outside world.
The same build, operated on your behalf, with every tenant on its own isolated database. For teams who want the model without owning the host.
05 The edge of the product
Published because you will find out anyway, and because a vendor who tells you late has told you too late.
That list will get shorter. We will not shorten it on this page before we shorten it in the product.
06 Commercials
An annual licence, scaled to the size of the landscape you model. Reading the architecture should never cost extra.
A walkthrough runs on your terms: a live model, the coverage view for your regime, and a straight answer about what Noveam cannot evidence for you. Thirty minutes. No slide deck.
Annual, per landscape. Unlimited readers.
Sized by the number of systems and providers you model, not by how many people log in.
Every capability on this site, in every deployment.
Start from exports you already produce. A first landscape in days.
Quoted in the walkthrough, against your estate.