Trust Center
Request audit reports and agreements, check control status and see how a security review with GONATURELLE runs.
- Documents available
- 5
- Controls listed
- 12
- Continuously monitored
- 6
- Questionnaire turnaround
- 5 days
Documents
Request each document separately. Your details carry over between requests, and the security team sends everything to the work email you enter.
- 1SOC 2 Type II reportSecurity, availability and confidentiality criteria. Twelve-month observation window.PDF, under NDA · updated 2026-09
- 2SOC 2 bridge letterCovers the period from the report end date to today.PDF · updated 2026-10
- 3HIPAA BAA packageBusiness associate agreement, HIPAA safeguards summary and breach notification terms.PDF + DocuSign · updated 2026-08
- 4Penetration test executive summaryAnnual third-party test of the web app, API, SDK and VPC data plane, with remediation status.PDF, under NDA · updated 2026-07
- 5CAIQ questionnaireCloud Security Alliance Consensus Assessments Initiative Questionnaire, completed.XLSX · updated 2026-10
Control status
The controls reviewers ask about first, the evidence behind each and when it was last tested.
| Family | Control | Evidence | Status | Last tested |
|---|---|---|---|---|
| Access | SAML SSO enforced for all staff and customer admin accounts | IdP config export, quarterly access review | Monitored continuously | 2026-10 |
| Access | SCIM deprovisioning within 1 hour of IdP removal | SCIM event log sample | Operating | 2026-09 |
| Access | Production access via short-lived, approved, logged sessions | Access broker logs | Monitored continuously | 2026-10 |
| Data | AES-256 encryption at rest for databases, object storage and backups | KMS key policies, config scan | Monitored continuously | 2026-10 |
| Data | TLS 1.2+ for all external and service-to-service traffic | TLS scan report | Monitored continuously | 2026-10 |
| Data | PHI and PII redaction on BYOD ingest | Detector test suite results | Operating | 2026-09 |
| Data | Zero data retention terms with every judge model provider | Executed provider agreements | Reviewed annually | 2026-06 |
| Change | Peer review and CI checks required on every production change | Branch protection settings, PR sample | Monitored continuously | 2026-10 |
| Resilience | Encrypted backups with quarterly restore tests | Restore test record | Operating | 2026-08 |
| Monitoring | Centralised logging with 1-year retention and alerting | SIEM rule export | Monitored continuously | 2026-10 |
| Vendor | Subprocessor security review before onboarding and annually | Vendor review records | Reviewed annually | 2026-05 |
| People | Security and HIPAA training at hire and annually | Training completion report | Reviewed annually | 2026-04 |
A security review in four steps.
Most reviews close in two to three weeks. Starting a 14-day trial does not need to wait for it: trial workspaces can run on GONATURELLE packs with no customer data.
- 01
Request documents
Pick the reports you need above. Public documents arrive by email; NDA documents follow a mutual NDA, which we sign the same day in most cases.
- 02
Questionnaire
Send your CAIQ, SIG Lite or custom questionnaire. Our pre-filled CAIQ answers most of it; the security team completes the rest within five business days.
- 03
Architecture review
A 45-minute call with our security and infrastructure leads covering deployment model, data flows, key management and incident response.
- 04
Agreements
BAA, DPA and enterprise terms signed in parallel. A BAA is available on every plan, so this step does not wait for an Enterprise contract.
Policies and references
- SubprocessorsEvery vendor that may process customer data, with purpose and region.
- HIPAA BAAOur standard business associate agreement and how to execute it.
- Data processing agreementGDPR and DPDP Act terms, including standard contractual clauses.
- System statusLive availability of the API, gate runners and dashboard.
- Security overviewControls, deployment models, data handling and identity.
- Report a vulnerabilityWrite to security@gonaturelle.si; acknowledged within one business day.
Frequently asked questions
Why are some documents under NDA?
The SOC 2 Type II report and the pen test executive summary describe our control environment and findings in detail. AICPA guidance restricts SOC 2 report distribution to user entities and prospects under appropriate terms, and the same logic applies to test findings.
How quickly will we receive the documents?
Public documents such as the bridge letter and CAIQ usually arrive within one business day. NDA documents follow once a mutual NDA is in place, typically the same day it is signed.
What does the control status table show?
The controls auditors and security reviewers ask about most, the evidence we keep for each, and when it was last tested. Continuously monitored controls are checked by automated tooling; others are tested on the cadence shown.
Do you support our own audit or a site visit?
Enterprise customers can audit GONATURELLE under the terms of their agreement, with reasonable notice. Most find the SOC 2 report and an architecture review sufficient.
Who owns security at GONATURELLE?
Ishita Banerjee, Head of Security & Compliance, owns the security program and the SOC 2 audit, and reports to the CTO, Rahul Venkataraman.
Start the trial while security reviews.
Trial workspaces run GONATURELLE packs against your agent without uploading customer data. 14 days, 5,000 runs, no card.