Security, Privacy & Compliance

Your data
stays yours.

See how your organization’s data, including proprietary research and PII, is protected and governed through controls for isolation, access, privacy, retention, and compliance.

Controls at a glance

SOC 2 compliant

Security and procurement teams can request our SOC 2 report, completed security questionnaires, standard DPA, and authorized subprocessor list under a non-disclosure agreement (NDA).

Review materialsStart a security review

  1. Start with nothing shared.

    No data sharing is required to start, because the corpus is already built.

    When you do bring your own data, what comes in, what is kept, and what leaves are all contract terms rather than platform defaults.

    Contract terms, not platform defaults
    • What comes in
    • What is kept
    • What leaves

    Native asks for the data the approved use case needs and no more. In most research activation workflows, unnecessary personal identifiers can be removed before ingestion without reducing the value of the simulation.

  2. Know who owns what.

    Your organization owns three things: the data and materials you provide, the deliverables created for you, and the twin configuration derived from your materials.

    Native owns its underlying platform, models, and methodology. Native processes your data only to deliver the contracted services.

    Your organization owns

    • The data and materials you provide
    • The deliverables created for you
    • The twin configuration derived from your materials

    Native owns

    • Its underlying platform
    • Its models
    • Its methodology

    Who owns the data we bring into Native?

  3. Personal data removed before use.

    Your PII never reaches a twin.

    Client data usually arrives with personal information already removed, and Native scrubs personal and sensitive information from the rest before the data is used.

    If PII arrives unexpectedly
    1. 1Native notifies the client
    2. 2Native removes or quarantines the data
    3. 3Native documents the fix

    Native can process respondent-level data where the client has the appropriate rights, notices, lawful basis and contract terms. It materially improves twin quality, and personal identifiers are removed before ingestion.

    How does Native handle PII?

  4. Kept encrypted and kept apart.

    Each organization works in tenant-isolated workspaces.

    One organization’s data, twins, and outputs stay invisible to every other organization. Clean-room environments are available for sensitive datasets.

    Cloud infrastructure

    Your tenant-isolated workspace

    Clean room, for sensitive datasets

    Encrypted in transit and at rest. Environments: strict separation across development, staging and production.

    Native encrypts data in transit and at rest, including cloud storage volumes and databases, on cloud infrastructure. Sensitive datasets also receive added controls such as clean rooms and restricted access.

    How is organizational data isolated?

  5. Control who can reach it.

    Every workspace includes role-based permissions, multi-factor authentication, and audit logging.

    Enterprise deployments add single sign-on, including SAML, configured with your identity provider during implementation, covering role mapping and user deactivation.

    Every workspace

    • Role-based permissions
    • Multi-factor authentication
    • Audit logging

    Enterprise deployments addConfigured with your identity provider during implementation

    • Single sign-on, including SAML
    • Role mapping
    • User deactivation

    Only authorized staff access client data.

    What access controls are available for enterprise teams?

  6. No training on your customer data.

    Native does not use your data, prompts, twin configurations, or outputs to train models or to support other customers.

    The AI models that power the platform never train on client data. Your data grounds your organization’s twins and nothing else.

    Documented in the applicable MSA, DPA and SOW
    Use
    Use of client data
    Training
    Model-training restrictions
    Retention
    Retention and deletion
    Third parties
    Any restrictions on third-party processing

    Native provides subprocessor and security information during procurement review where appropriate and subject to confidentiality requirements.

    Is our data used to train shared or global AI models?

  7. Kept, returned or deleted on your terms.

    Your MSA, DPA, and SOW set the retention and deletion terms.

    At contract end, Native returns your data on request and deletes the data.

    • MSA
    • DPA
    • SOW
    • Your instructions

    Can we control data retention and deletion?

  8. Hand it to your security team.

    Native AI is SOC 2 compliant.

    SOC 2 compliant

    Available under NDA

    • SOC 2 report
    • Completed security questionnaires
    • Standard DPA
    • Authorized subprocessor list

    Security and procurement teams can request our SOC 2 report, completed security questionnaires, standard DPA, and authorized subprocessor list under a non-disclosure agreement (NDA).

    What compliance standards does Native support?Compliance detail: GDPR, transfers, EU AI Act

Compliance

SOC 2
Native AI is SOC 2 compliant. The report is made available to qualified customers under NDA where appropriate, and the current status is confirmed during procurement.
GDPR and UK GDPR
Native supports GDPR and UK GDPR-aligned engagements for UK and European clients. The applicable posture depends on the use case, data flow, data categories, lawful basis, controller and processor roles, transfer mechanism and contract terms, all confirmed in the MSA, DPA and SOW for each engagement.
International transfer
For UK or EU personal data transferred outside the UK or EEA, the parties confirm the applicable safeguard. Depending on the data flow this may be EU Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU SCCs, or another valid mechanism.
EU AI Act
Obligations depend on the role of each party, the use case, and risk classification. Native is positioned as a research activation and decision support platform. A use case where twin outputs could materially affect individuals receives legal, compliance and Native review before launch.

Decision support, not autonomous decisions
Native outputs inform research, insights, marketing, innovation and strategy decisions. They are not built to make autonomous high-impact determinations about individuals, including legal, medical, credit or employment decisions.
Human review
Client teams review outputs, limitations and validation context before results are used in material decisions.
Scope control
Each twin is used within the approved audience, data and use-case scope.
Output controls
Native supports workflows where outputs are more tightly constrained to source data, depending on the objective.
Regulated use cases
Pharma, healthcare, financial services, children and youth data, special category data, and HCP or patient data receive governance review before commitments are made.

Procurement and security review packet
MaterialAvailability
SOC 2 reportAvailable to qualified customers under NDA where appropriate. Current status confirmed during procurement.
Security questionnaire responsesSupported as part of formal vendor-risk review.
DPA and data processing termsHandled through contract review, based on role allocation and data flow.
Subprocessor informationAvailable where appropriate during procurement, subject to confidentiality.
Data flow and architecture overviewAvailable at a suitable level of detail for qualified prospects and clients.
Retention and deletion confirmationDocumented in the applicable MSA, DPA, SOW or security review.
Sensitive-data handling approachAvailable for regulated or sensitive engagements, including PII removal and enhanced controls where scoped.

Frequently asked questions

Your data stays yours, stays isolated, and is governed by your contract.

Your organization owns three things: the data and materials you provide, the deliverables created for you, and the twin configuration derived from your materials. Native owns its underlying platform, models, and methodology. Native processes your data only to deliver the contracted services.

No. Native does not use your data, prompts, twin configurations, or outputs to train models or to support other customers. The AI models that power the platform never train on client data. Your data grounds your organization’s twins and nothing else.

Each organization works in tenant-isolated workspaces. One organization’s data, twins, and outputs stay invisible to every other organization. Clean-room environments are available for sensitive datasets.

Native encrypts data in transit and at rest, including cloud storage volumes and databases, on cloud infrastructure. Sensitive datasets also receive added controls such as clean rooms and restricted access.

Your PII never reaches a twin. Client data usually arrives with personal information already removed, and Native scrubs personal and sensitive information from the rest before the data is used. If PII arrives unexpectedly, Native notifies the client, removes or quarantines the data, and documents the fix. Only authorized staff access client data. Retention and deletion follow your contract.

Every workspace includes role-based permissions, multi-factor authentication, and audit logging. Enterprise deployments add single sign-on, including SAML, configured with your identity provider during implementation, covering role mapping and user deactivation.

Yes. Your MSA, DPA, and SOW set the retention and deletion terms. At contract end, Native returns your data on request and deletes the data.

Native AI is SOC 2 compliant. We support GDPR- and UK GDPR-aligned engagements, formalizing operational roles, lawful bases, and cross-border transfer safeguards, including EU Standard Contractual Clauses (SCCs) and the UK Addendum, within our Data Processing Agreement (DPA). Security and procurement teams can request our SOC 2 report, completed security questionnaires, standard DPA, and authorized subprocessor list under a non-disclosure agreement (NDA).

The detail behind these answers is available to review.

For a security questionnaire, SOC 2 report access, DPA review or a regulated-data assessment, Native provides the materials under NDA and works with your team to confirm the data flow and governance model. Start a security review

Back to the Trust Center
Start a pilot