Security for teams whose test cases contain PHI.
SOC 2 Type II, a BAA on every plan, zero data retention and deployment inside your own VPC or air-gapped cluster.
- SOC 2 Type IICurrent report
- HIPAA BAAAll plans
- Model training on customer dataNever
- Judge provider retentionZero (ZDR)
- EncryptionAES-256 / TLS 1.2+
- Penetration testAnnual, under NDA
- Data residencyUS, India, your VPC
The controls your security review will ask about.
- SOC 2 Type IIIndependent audit of security, availability and confidentiality controls over a twelve-month window. Report and bridge letter on request.
- HIPAA BAA on every planSigned before your first PHI-bearing case is uploaded, Developer tier included. Safeguards summary in the BAA package.
- Zero data retention, no trainingZDR terms with every judge model provider. Your cases, prompts and outputs never train any model, ours or theirs.
- Your cloud or your clusterMulti-tenant US or India, single-tenant VPC on AWS, GCP or Azure, or air-gapped Kubernetes with no egress.
- SAML SSO, SCIM, RBACOkta and Microsoft Entra ID, automatic deprovisioning, per-suite roles and an audit log of every threshold change.
- Annual third-party pen testWeb app, API, SDK and the VPC data plane. Executive summary and remediation status shared under NDA.
Choose where evaluation runs. See exactly what moves.
Pick a deployment model, then hover a data flow to see which components it connects and whether it crosses your network boundary.
Multi-tenant cloud, US
Developer, Scale, EnterpriseFastest start. Your CI runner sends cases and captured trajectories to GONATURELLE over TLS; sandboxes and judges run in GONATURELLE's US region with logical tenant isolation.
- Your CI runner + SDK
- Your agent endpoint
- GONATURELLE API (US)
- Sandboxed eval workers
- Encrypted result store
- Judge model providers (ZDR)
- Test inputs and agent outputs for evaluated cases
- Captured tool-call trajectories
- Judge prompts sent under zero-data-retention terms
- Your agent code and model weights
- Production traffic (GONATURELLE never sees it)
- Secrets in your CI vault
Data handling
Test cases in regulated work often start life as real records. These are the rules that apply from the moment one is uploaded.
PHI and PII are redacted before a BYOD case is stored.
Your data never trains a model.
Not ours, not a provider’s. Contractual, and enforced through ZDR terms with every judge provider.
Keep run content for 7 to 365 days, or scores only.
Every vendor that can touch customer data is listed.
SSO, SCIM and roles scoped to suites.
SAML 2.0 SSO with Okta and Microsoft Entra ID, with SSO enforcement per workspace. SCIM 2.0 provisions users and groups and removes access when someone leaves your IdP. Roles apply per suite, so a clinical reviewer can label healthcare cases without seeing the credit suite.
CI tokens are scoped to one workspace, can trigger runs but never read case content, and every threshold change is written to the audit log with the actor and diff.
| Permission | Owner | Admin | Suite maintainer | Reviewer | Viewer | CI token |
|---|---|---|---|---|---|---|
| Manage SSO, SCIM and billing | ||||||
| Invite users and assign roles | ||||||
| Create suites, import BYOD data | ||||||
| Change gate thresholds | ||||||
| Label and adjudicate cases | ||||||
| View case content and outputs | ||||||
| View scores and run reports | ||||||
| Trigger runs from CI | ||||||
| Export compliance reports |
Encryption, isolation and testing
An independent firm tests the web application, API, SDK and VPC data plane every year. The executive summary, findings by severity and remediation status are shared under NDA.
Request the pen test summary- At rest
- AES-256 for databases, object storage, queues and backups. Customer-managed keys (AWS KMS, Cloud KMS, Azure Key Vault) in VPC deployments.
- In transit
- TLS 1.2 or higher on every external endpoint and between services; HSTS on all web properties.
- Secrets
- Model provider keys and CI tokens stored in a managed secrets service, scoped per workspace, rotated on demand.
- Run integrity
- SHA-256 manifest over dataset version, prompts, model ids, judge config and scores for every gated run.
- Isolation
- Each evaluation runs in a sandboxed worker with no shared filesystem and egress limited to your agent endpoint and approved judges.
- Logging
- Centralised, tamper-evident audit logs of access, threshold changes and exports, retained for one year.
Frequently asked questions
Do you sign a BAA on the Developer plan?
Yes. A HIPAA business associate agreement is available on every plan, including Developer. Request it from the Trust Center or at legal@gonaturelle.si before uploading any case that contains PHI.
Is our data used to train models?
No. Customer test cases, prompts, agent outputs and traces are never used to train GONATURELLE models or any third-party model. Judge calls go to providers under zero-data-retention terms, and in VPC or air-gapped deployments judges run through your own model accounts or on your own hardware.
Where is data stored?
In the multi-tenant cloud you choose a US or India region at workspace creation. In single-tenant VPC deployments everything stays in your cloud account and region; in air-gapped deployments nothing leaves your cluster.
Is GONATURELLE in our production request path?
No. GONATURELLE is an offline pre-production and regression evaluation engine. It does not proxy production traffic or act as a runtime firewall, so an GONATURELLE outage cannot take down your agent.
Can we see the penetration test report?
The executive summary and remediation status are available under NDA through the Trust Center. Enterprise customers may also run their own test against a dedicated environment with notice.
How do we report a vulnerability?
Email security@gonaturelle.si. We acknowledge reports within one business day and do not pursue good-faith researchers who follow our disclosure policy.
GONATURELLE provides automated testing and evaluation software. SOC 2 reports and a BAA describe GONATURELLE’s own controls; they do not certify your AI system, and you remain responsible for your deployment decisions and regulatory obligations.
Send us your security questionnaire.
Our security team, led by Ishita Banerjee, answers CAIQ, SIG and custom questionnaires. Write to security@gonaturelle.si or request documents from the Trust Center.