Security at Naitra

How Naitra protects audit evidence and customer data, described in plain terms and matched to how the product is actually built.

Encryption

Customer data is encrypted in transit and at rest. Evidence uploads are encrypted with AWS Key Management Service using server-side encryption with KMS-managed keys (SSE-KMS). Connector credentials you provide are protected with envelope encryption, where the data key itself is wrapped by a KMS key and the plaintext key is never stored.

Evidence integrity and immutability

Evidence is held in immutable storage using Amazon S3 Object Lock in governance mode, with a multi-year retention period applied at write time. Every stored artifact carries a SHA-256 integrity hash, so any change to a file is detectable. This keeps the evidence behind a finding stable for the life of the engagement record.

Authentication and access

• Multi-factor authentication. Time-based one-time password (TOTP) MFA is supported, and an organization administrator can require it for every member of the organization.
• Session timeout. Sessions end after 30 minutes of inactivity and require re-authentication.
• Role-based access control. Access is gated by four roles, admin, auditor, reviewer, and read-only, enforced on protected routes.

Tenant isolation

Each customer's data is isolated from every other customer's. Isolation is enforced at the application layer on every database query: a tenant identity is required at runtime, it is injected into and validated on each query, and a query that cannot resolve its tenant context is rejected rather than allowed to read across organizations.

Audit logging

Security-relevant actions are recorded in a tamper-evident audit log. Each entry captures the acting user and the source IP address, and entries are cryptographically signed and chained so that any later alteration of the record is detectable.

AI processing

Naitra uses the Anthropic API to process audit content. Customer data sent for AI processing is never used to train models and is retained for no more than 30 days. Every AI call is logged with the tenant and the user who triggered it, giving a complete, attributable record of the AI activity in your account.

Encryption keys

Naitra manages encryption keys through AWS KMS. Dedicated per-customer encryption keys are available on request for organizations that want their evidence and credentials encrypted under a key reserved to them.

On the roadmap

Single sign-on and SAMLBeta roadmap are planned. Today, authentication is email and password with optional TOTP multi-factor authentication.

Some capabilities described here, such as dedicated per-customer keys, are provisioned on request rather than enabled by default.