Autonomous IT operations under full control

Many times faster.Around the clock.Competent.

56% of our support hours are in tickets that can be automated. Those are the ones nordnung.ai takes over. Controlled, auditable, hosted in Germany.

Watch the 100-second video

Hosted in Germany
Built for GDPR
Tenant isolation
Audit log + kill switch

nordnung.ai in 100 seconds

The product flow at speed: from the call to the documented resolution.

Why now

Today the AI revolution ends at copy and paste.

nordnung.ai: what we do about it

> make shadow_ai visible

Visible, governable, auditable. ✓

Measured, not estimated

Measured on 1,348 real tickets

56%

of support hours are in tickets that can be automated

86%

of tickets: nordnung.ai can at least assist

1,348

real customer tickets analyzed, each classified individually

The standard cases

Password reset & account unlockfull
Onboarding new colleaguesapproval
Mailbox & folder permissionsfull
Licensing & standard softwarefull / partial
Offboarding & departuresfull

Read the case study →

Measured in a real stack:

Microsoft 365
Active Directory
Exchange & Outlook
Microsoft Teams
DATEV
3CX
Nextcloud
Terminal servers
MFP devices

* 1,348 real tickets, operating hours since 2023, individually classified. No extrapolation. “Approval” = the human share stays with you.

Same work, a third of the cost

⅓

of the cost for the same work

~€20 per completed task, relative to one technician hour

external provider, per technician hourfrom €120
internal, full cost per technician hour€60
with nordnung.ai, for the same work~€20

Agent time included. No extra costs up to full utilization.

See pricing →

Scenario lab

Experience controlled autonomy

Real recordings from our demo environment

Reconnect Outlook

54 of 1,348 tickets · ≈ 4% · #4 in the dataset

After your approval, the Endpoint Agent turns off Outlook's offline mode and checks the outbox.

English narration and subtitles. Screen recordings use the German interface.

nordnung Cosmos

Two interaction agents stay close to the user. Four execution agents carry out defined actions in technical environments.

Phone Agent

Interaction agent

No system access

Can do:Handles phone and chat intake, captures context, and structures the request.

Cannot do:No direct system execution or privileged endpoint actions.

Protection:Session-bound scope with explicit handover into execution agents.

Examples:Initial triage, guided clarification, user-facing updates.

Vision Agent

Interaction agent

Image analysis for real devices

Can do:Analyzes uploaded photos to classify physical support incidents.

Cannot do:No direct writes to infrastructure or endpoint command execution.

Protection:Image-only analysis pipeline with scoped output into workflow decisions.

Examples:Printer panel diagnostics, cable and port checks, hardware triage.

Endpoint Agent

Execution-Agent

Client and user session

Can do:Reads local system state, interacts with the user session, and executes approved desktop steps.

Cannot do:No access to other user profiles, no kernel driver changes, and no access to internal servers.

Protection:Kill switch, visible session consent, and per-action approval.

Examples:Teams reset, printer spooler restart, VPN toggle.

Cowork Agent

Execution-Agent

Isolated browser and legacy execution

Can do:Accesses legacy web UIs, runs isolated browser sessions, and interacts with IoT and printer workflows.

Cannot do:No access to the corporate network, no persistent data storage, and no access to domain controllers.

Protection:Isolated VM, ephemeral sessions, and no inbound traffic.

Examples:MFP address book update, legacy ERP data entry.

Critical Systems Agent

Execution-Agent

Controlled infrastructure actions

Can do:Executes defined actions on sensitive systems, such as AD user creation or password reset.

Cannot do:No free shell access, no software installation, and no system registry modification.

Protection:Predefined script whitelist only, no interactive shell.

Examples:AD user creation, password reset, session management.

Cloud Agent

Execution-Agent

Applications and connectors

Can do:Assigns licenses, sets mailbox permissions, and manages SharePoint sites through approved methods.

Cannot do:No access to user emails, no deletion of root sites, and no changes to global security settings.

Protection:Wrapped Graph API calls with OAuth scopes limited to least privilege.

Examples:Mailbox delegation, license assignment, OneDrive setup.

See all six agents

Governance and security

Controlled autonomy for us means clear approvals, hosting in Germany, and technical boundaries that can be reviewed transparently.

Go to security page

Create M365 user

Risk: High

More approvals

Defined operating modes

Actions run only within defined operating modes and with the approvals that match each scope.

Technically enforced safeguards

Credentials, wrapper actions, least privilege, a four-eyes check by the security agent, audit logs, and a kill switch are technically enforced.

Hosted in Germany

Hosting in Germany, an operating model built for GDPR requirements, and transparent provider boundaries are documented and reviewable.

Full security model

Credential security, operating model, audit logging, data flow, and the review process live on the security page.

Pricing

What it costs, and what comes back.

One flat fee for the platform, one per device. Agent time included.

See pricing

⅓

of the cost for the same work

~€20 per completed task, relative to one technician hour

Cost comparison based on typical benchmarks per completed task, relative to one technician hour. Not a guarantee.

Frequently asked questions

We use strict execution levels and wrapper actions. Agents cannot execute arbitrary code; they can only call predefined, parameterized functions that have been subjected to a security review.

No. Free shell access is strictly prohibited. All PowerShell scripts are prescribed, parameterized and executed as wrapper actions.

The nordnung Agent works with operating modes for the Endpoint Agent. Depending on the mode, every action requires approval or just initial approval before work can be carried out autonomously within the permitted scope.

Every API call, parameter, approval signature and system state change is recorded in encrypted logs with integrity verification. This provides a complete audit trail for compliance and troubleshooting.

Today, nordnung.ai is operated by us in Germany within a model built for GDPR. If you need a different operating setup or dedicated deployment target, we discuss that architecture directly with you.

Every customer gets a dedicated tenant, technically fully independent from all other tenants.

We use our Cloud Agent (Layer 4), which interacts exclusively via the Microsoft Graph API and uses least-privilege OAuth scopes.

Our platform is built for German and EU compliance. Visible session consent, kill switch, audit logs, hosting in Germany, and an operating model built for GDPR requirements are designed to meet typical works council and compliance requirements.

Next Step

Start with a demo, a ticket analysis, or a security review

Controlled agent logic, clear boundaries, traceable execution, for IT operations in enterprise environments. nordnung.ai is in production.

Hosted in Germany

Operated to GDPR requirements

Built from practice

Years of IT management and support experience

Security review Free ticket analysis

Autonomous IT operations under full control

nordnung.ai in 100 seconds

Today the AI revolution ends at copy and paste.

Shadow AI is already running.

Standard cases eat senior time.

Uncontrolled AI is the real risk.

Waiting is the most expensive option.

Measured on 1,348 real tickets

Experience controlled autonomy

nordnung Cosmos

Phone Agent

Vision Agent

Endpoint Agent

Cowork Agent

Critical Systems Agent

Cloud Agent

Governance and security

Defined operating modes

Technically enforced safeguards

Hosted in Germany

Full security model

What it costs, and what comes back.

Frequently asked questions

Start with a demo, a ticket analysis, or a security review