Security at Naitra

How Naitra protects audit evidence and customer data, described in plain terms and matched to how the product is actually built.

Encryption

Customer data is encrypted in transit and at rest. Evidence uploads are encrypted with AWS Key Management Service using server-side encryption with KMS-managed keys (SSE-KMS). Connector credentials you provide are protected with envelope encryption, where the data key itself is wrapped by a KMS key and the plaintext key is never stored.

Evidence integrity and immutability

Evidence written today is held in immutable storage using Amazon S3 Object Lock in governance mode, with a multi-year retention period applied at write time. Every stored artifact carries a SHA-256 integrity hash, so any change to a file is detectable. A legacy read-only evidence path exists in Supabase Storage for records written before the move to S3. Those records are read-only and hashed, and are not under Object Lock. This keeps the evidence behind a finding stable for the life of the engagement record.

Authentication and access

• Multi-factor authentication. Time-based one-time password (TOTP) MFA is supported, and an organization administrator can require it for every member of the organization.
• Session timeout. Sessions end after 30 minutes of inactivity and require re-authentication.
• Role-based access control. Access is gated by four roles, admin, auditor, reviewer, and read-only, enforced on protected routes.

Tenant isolation

Each customer's data is isolated from every other customer's. Isolation is enforced at the application layer on every database query: a tenant identity is required at runtime, it is injected into and validated on each query, and a query that cannot resolve its tenant context is rejected rather than allowed to read across organizations.

Audit logging

Security-relevant actions are recorded in a tamper-evident audit log. Each entry captures the acting user and the source IP address, and entries are cryptographically signed and chained so that any later alteration of the record is detectable.

AI processing

Naitra uses the Anthropic API to process audit content. Customer data sent for AI processing is never used to train models and is retained for no more than 30 days. Every AI call is logged with the tenant and the user who triggered it, giving a complete, attributable record of the AI activity in your account.

Encryption keys

Naitra manages encryption keys through AWS KMS. Dedicated per-customer encryption keys are available on request for organizations that want their evidence and credentials encrypted under a key reserved to them.

On the roadmap

Single sign-on with SAML is planned. Today, authentication is email and password with optional time-based one-time password multi-factor authentication, which an organization administrator can require for every member.

Independent assurance

Naitra does not hold a SOC 2 report today. A SOC 2 Type 1 examination is planned. Until a report is available we will complete your security questionnaire, walk your team through the controls described on this page, and provide our subprocessor list and data flow on request.

Health information

Naitra will enter into a Business Associate Agreement with organizations that are covered entities or business associates under HIPAA. Contact support@naitra.ai before placing protected health information in the platform.

Deletion

On termination your organization exports its content, after which Naitra deletes it. For organizations using a dedicated encryption key, deletion can be effected by destroying that key, which renders the data permanently unreadable without touching the underlying storage. Evidence held under an active immutability retention period is deleted when that period lapses.