How engagement information is handled

The standing terms

1. Confidentiality. Confidentiality terms sit in the engagement letter. Where your organization requires its own non-disclosure agreement, Naitra signs yours rather than asking you to accept ours.
2. Where material is held. Engagement material is held in the United States. Where your organization requires that material never leave your own systems, engagements are run inside your environment and Naitra holds nothing.
3. Retention and deletion. Engagement material is retained for 12 months after the engagement closes, so that questions raised later can be answered from the record. It is then deleted. Where you would rather it be deleted at close, say so in the engagement letter and it is deleted within 30 days of close.
4. Subcontractors. Engagements are performed by Naitra personnel. No subcontractor is engaged and no material is shared with one without your written approval first.
5. Artificial intelligence and model training. Your material is not used to train Naitra models. Where AI assisted tooling is used inside an engagement, the tools and the terms they run under are disclosed at scoping, and you can require that specific tools be excluded. The engagement record shows where such tooling was used and what a person reviewed.
6. Ownership of deliverables. Deliverables produced for you are yours on payment, including source code produced under a prototype or automation engagement. Naitra keeps its own pre-existing methods, templates, and tooling, which are not part of what is delivered.
7. Ownership of workpapers. Workpapers produced on an assurance engagement are yours. On co-sourced work they are filed in your system of record as they are created. On other engagements they are handed over at close. Naitra keeps a copy under the retention term above and for no other purpose.
8. Sending evidence. Evidence is exchanged through your own systems wherever you have them, which is the usual answer for a regulated organization. Where you do not, an encrypted channel is agreed at scoping. Evidence is not requested or accepted as an email attachment.
9. If something goes wrong. If engagement material is exposed or accessed without authorization, you are notified without undue delay and within 72 hours of Naitra becoming aware, with what is known at the time, what is not yet known, and what is being done.