GDPR-conscious outbound, built in Europe

NorReach is built in Stockholm for teams that reach people in Europe. Its controls sit at the point of send: a recorded lawful basis, one suppression list across every channel and sending windows, on every plan.

Get a demo See the features

EU-hosted workspace data. A DPA is available on request.

Features for this need

Where the controls live

Every feature page lists its own guardrails, and what it won't do.

See every feature

Why it fits

Controls at the point of send

A lawful basis, recorded
A campaign, flow or broadcast step won't send to a contact without a recorded lawful basis. You choose the basis; NorReach makes sure one is recorded.
Disclosure on AI calls
Plan calls always open by naming your company and the person they call for. The rest of the opening is your AI caller's first line, which you set, and that is where it says it's an AI, as the EU AI Act (Art. 50) requires. Call coaching flags calls that miss a required disclosure.
LinkedIn at a human pace
LinkedIn steps (beta) run in your own logged-in session with a human pace and daily caps, not through a back-door API. LinkedIn limits automation even in your own session, so the account and its limits stay yours.

Guardrails

The rest of the rulebook

Unsubscribes, STOP replies, bounces and blocks go on one suppression list that covers every channel, and every campaign, flow and broadcast step checks it before it sends.
Campaigns send inside a sending window (by default weekdays 09:00–17:00 in each contact's time zone, where it's known) and hold calls, texts and WhatsApp overnight. It's on by default for new campaigns; plan touches go out on the day and time shown on their card.
Switch on an inbox's opt-out line and its sequence emails carry a real one-click unsubscribe link plus List-Unsubscribe headers.
An append-only audit log records Nora's agent actions, the approvals and Autopilot decisions behind them, and workspace-wide actions such as pausing all outreach.
One button pauses all outreach and cancels queued messages.
Your workspace data is hosted in the EU. Some sub-processors (such as AI models, telephony and email delivery) may process data outside the EU under standard contractual clauses.

Shared responsibility

What NorReach does, and what stays with you

The product enforces the rules at the point of send. The decisions about who you contact, and why, stay yours.

NorReach

Checks for a recorded lawful basis before a campaign, flow or broadcast step sends
Checks the same steps against one suppression list, fed by unsubscribes, STOP replies, bounces and blocks
Holds calls, texts and WhatsApp overnight while a campaign's sending window is on
Keeps per-inbox, per-number and LinkedIn daily limits
Lets you delete a contact, or the whole workspace

You

Choose and document the lawful basis for each contact
Decide who you contact, and why
Set your AI caller's opening line, where it says it's an AI
Ask for a DPA, which is available on request

Keep reading

FAQ

Questions, answered

Where is my data stored?

Your workspace data is hosted in the EU. Some sub-processors (such as AI models, telephony and email delivery) may process data outside the EU under standard contractual clauses. A DPA is available on request.

Do you hold ISO 27001 or SOC 2?

Not at this time. NorReach offers EU-hosted data, GDPR features and a DPA on request. We don't claim certifications we don't hold, and NorReach is a GDPR product, not a HIPAA one.

Do the AI calls say they're an AI?

Plan calls always open by naming your company and the person they call for. The rest of the opening is your AI caller's first line, which you set, and that is where it says it's an AI, as the EU AI Act (Art. 50) requires. Call coaching flags calls that miss a required disclosure.

Does NorReach decide our lawful basis?

No. You choose and document the lawful basis for each contact; NorReach makes sure one is recorded before a campaign, flow or broadcast step sends.

What happens when someone opts out?

Unsubscribes, STOP replies, bounces and blocks go on one suppression list that covers every channel, and every campaign, flow and broadcast step checks it before it sends. Switch on an inbox's opt-out line and its sequence emails carry a real one-click unsubscribe link plus List-Unsubscribe headers.