Autonomous IT operations under full control

Many times faster.Around the clock.Consistent quality.

56% of our support hours are in tickets that can be automated. Those are the ones nordnung.ai takes over. Controlled, auditable, hosted in Germany.

Watch the 100-second video

Hosted in Germany
Built for GDPR
Tenant isolation
Audit log + kill switch

nordnung.ai in 100 seconds

The product flow at speed: from the call to the documented resolution.

Why now

Today the AI revolution ends at copy and paste.

nordnung.ai: what we do about it

> make shadow_ai visible

Visible, governable, auditable. ✓

Measured, not estimated

Measured on 1,348 real tickets

56%

of support hours are in tickets that can be automated

86%

of tickets: nordnung.ai can at least assist

1,348

real customer tickets analyzed, each classified individually

The standard cases

Password reset & account unlockfull
Onboarding new colleaguesapproval
Mailbox & folder permissionsfull
Licensing & standard softwarefull / partial
Offboarding & departuresfull

Read the case study →

Measured in a real stack:

Microsoft 365
Active Directory
Exchange & Outlook
Microsoft Teams
DATEV
3CX
Nextcloud
Terminal servers
MFP devices

* 1,348 real tickets since July 2023, individually classified. No extrapolation. “Approval” = the human share stays with you.

The savings in practice

€47,710

saved per year, after all nordnung flat fees

managed devices in the setup203
real tickets in 12 months, individually classified1,348
team hours freed per year1,263 h

Agent time included. The example uses 15 %, and up to full utilization there are no extra costs.

See pricing →

Scenario lab

Experience controlled autonomy

Real recordings from our demo environment

Onboarding workflow

38 of 1,348 tickets · ≈ 3% · most frequent single case

Account, M365, Outlook, MFP address book in one run, with a visible approval stop.

nordnung Cosmos

Two interaction agents stay close to the user. Four execution agents carry out defined actions in technical environments.

Phone Agent

Interaction agent

No system access

Can do:Handles phone and chat intake, captures context, and structures the request.

Cannot do:No direct system execution or privileged endpoint actions.

Protection:Session-bound scope with explicit handover into execution agents.

Examples:Initial triage, guided clarification, user-facing updates.

Vision Agent

Interaction agent

Image analysis for real devices

Can do:Analyzes uploaded photos to classify physical support incidents.

Cannot do:No direct writes to infrastructure or endpoint command execution.

Protection:Image-only analysis pipeline with scoped output into workflow decisions.

Examples:Printer panel diagnostics, cable and port checks, hardware triage.

Endpoint Agent

Execution-Agent

Client and user session

Can do:Reads local system state, interacts with the user session, and executes approved desktop steps.

Cannot do:No access to other user profiles, no kernel driver changes, and no access to internal servers.

Protection:Kill switch, visible session consent, and per-action approval.

Examples:Teams reset, printer spooler restart, VPN toggle.

VM Agent

Execution-Agent

Isolated browser and legacy execution

Can do:Accesses legacy web UIs, runs isolated browser sessions, and interacts with IoT and printer workflows.

Cannot do:No access to the corporate network, no persistent data storage, and no access to domain controllers.

Protection:Isolated VM, ephemeral sessions, and no inbound traffic.

Examples:MFP address book update, legacy ERP data entry.

Critical Systems Agent

Execution-Agent

Controlled infrastructure actions

Can do:Executes defined actions on sensitive systems, such as AD user creation or password reset.

Cannot do:No free shell access, no software installation, and no system registry modification.

Protection:Predefined script whitelist only, no interactive shell.

Examples:AD user creation, password reset, session management.

Cloud Agent

Execution-Agent

Applications and connectors

Can do:Assigns licenses, sets mailbox permissions, and manages SharePoint sites through approved methods.

Cannot do:No access to user emails, no deletion of root sites, and no changes to global security settings.

Protection:Wrapped Graph API calls with OAuth scopes limited to least privilege.

Examples:Mailbox delegation, license assignment, OneDrive setup.

See all six agents

Governance and security

Controlled autonomy for us means clear approvals, hosting in Germany, and technical boundaries that can be reviewed transparently.

Go to security page

M365-Benutzer anlegen

Risiko: Hoch

More approvals

Defined operating modes

Actions run only within defined operating modes and with the approvals that match each scope.

Technically enforced safeguards

Credentials, wrapper actions, least privilege, a four-eyes check by the security agent, audit logs, and a kill switch are technically enforced.

Hosted in Germany

Hosting in Germany, an operating model built for GDPR requirements, and transparent provider boundaries are documented and reviewable.

Full security model

Credential security, operating model, audit logging, data flow, and the review process live on the security page.

Frequently asked questions

We use strict execution levels and wrapper actions. Agents cannot execute arbitrary code; they can only call predefined, parameterized functions that have been subjected to a security review.

No. Free shell access is strictly prohibited. All PowerShell scripts are prescribed, parameterized and executed as wrapper actions.

The nordnung Agent works with operating modes for the Endpoint Agent. Depending on the mode, every action requires approval or just initial approval before work can be carried out autonomously within the permitted scope.

Every API call, parameter, approval signature and system state change is recorded in encrypted logs with integrity verification. This provides a complete audit trail for compliance and troubleshooting.

Today, nordnung.ai is operated by us in Germany within a model built for GDPR. If you need a different operating setup or dedicated deployment target, we discuss that architecture directly with you.

Every customer gets a dedicated tenant, technically fully independent from all other tenants.

We use our Cloud Agent (Layer 4), which interacts exclusively via the Microsoft Graph API and uses least-privilege OAuth scopes.

Our platform is built for German and EU compliance. Visible session consent, kill switch, audit logs, hosting in Germany, and an operating model built for GDPR requirements are designed to meet typical works council and compliance requirements.

Next Step

Start with a demo, pilot, or security review

Controlled agent logic, clear boundaries, traceable execution, for real IT operations environments. The first complete version is in production; we develop it further with more customers.

Hosted in Germany

Operated to GDPR requirements

Built from practice

Years of IT management and support experience

Security review For investors

nordnung.tel

The AI phone assistant as a product of its own.

Structured call intake with handoff to CRM, ticketing, and calendar.

Phone-first
System handoff
Callbacks

Visit nordnung.tel

Autonomous IT operations under full control

nordnung.ai in 100 seconds

Today the AI revolution ends at copy and paste.

Shadow AI is already running.

Routine eats senior time.

Uncontrolled AI is the real risk.

Waiting is the most expensive option.

Measured on 1,348 real tickets

Experience controlled autonomy

nordnung Cosmos

Phone Agent

Vision Agent

Endpoint Agent

VM Agent

Critical Systems Agent

Cloud Agent

Governance and security

Defined operating modes

Technically enforced safeguards

Hosted in Germany

Full security model

Frequently asked questions

Start with a demo, pilot, or security review

The AI phone assistant as a product of its own.