NatusAIStays inside by default
- Source documents, business records and their history
- Logs of who asked, what was used and what was decided
- Extracts and search indexes, which never get wider access than their source
- Home
- Trust
Sovereign, governed and recoverable: AI that stays under your control
Control starts with practical questions: who owns the information, who may use it, where it runs, what can leave and how you recover. We answer them in the architecture, before anything is built.
Ownership & sovereignty
Sovereignty: you decide where it runs and what leaves
Your data, the models you choose and the applications we build are yours. They run in the environment your risk profile requires, and we plan the exit at the start, not at the end.
On-premises
On your own servers, including standard IT hardware, with local AI models where required.
Sovereign cloud
European hosting under contracts you approve, with a choice of EU-hosted AI models.
Hybrid
Sensitive data on-premises, other workloads in the cloud, one governance model; in-country where law requires it.
Model-agnostic. We use the AI models your policy allows: hosted, EU-hosted or running locally.
Data boundary
Your data boundary, written into the architecture
“Never leaves” is a promise no honest vendor makes for every setup. We do something more useful: we list every data flow, and you decide each one.
Crosses only by your decision
- Calls to an external AI model, if your policy allows one
- Connections to outside systems, each listed and approved
- Support access by our team, scoped and time-limited
Documented for procurement
- A data-flow map for your DPO and CISO
- Information for your DORA ICT third-party register
- An exit and handover plan: what you receive and how you move
A remote AI service can mean data leaves your environment. When that is acceptable, it is a recorded choice, not a default.
AI providers remain part of the data decision
Select providers and models against an application’s requirements. Remote, externally managed local and qualified Cygnus-managed local runtimes have different operational boundaries.
Remote API
A remote API can involve data leaving the deployment.
Operator-run local service
An operator-run local service is not automatically covered by Cygnus memory guarantees.
Cygnus-managed local runtime
A Cygnus-managed local runtime requires qualification of its exact model, runtime, configuration and device combination.
No universal offline, residency or privacy promise follows from a product name. Planned AI support and limits
Evidence & human control
Governance: every answer has a source, every action an owner
AI proposes and people decide. Our applications give compliance, risk and audit teams what they need to supervise AI.
Sources you approve
AI uses only the documents and systems you connect, and shows which ones it used.
People who decide
Consequential actions wait for a named approver. An AI agent cannot approve its own change or widen its own access.
Records you keep
Who asked, what was used, what was decided and when, stored in your environment.
Quality you can measure
We test answers before rollout and keep improving them with real cases.
Measured in delivered projects
89%
of enquiries in the 12 automated categories resolved without human intervention; complex cases escalated to people
Security & recovery
Security and recovery: tested, not assumed
A backup only counts when a restore has been tested. Access is checked before anything is shown. And the platform keeps a route back if a component or AI provider fails.
Access before disclosure
Permissions are checked before data is shown, searched or ranked, so denied information does not leak through counts or hints.
Text never grants authority
Documents and AI output are treated as content to inspect. Only your permissions can authorise an action.
Verified recovery
Recovery points, restore drills and their evidence: NatusAI Gemini (Roadmap). Today: recovery and exit are planned in every engagement.
Operations in context
Every incident is linked to the application and release it affects: NatusAI Draco (Roadmap).
Regulation map
Regulation map: what our controls are designed to support
We support your obligations. We do not certify your systems or replace your legal assessment.
| Framework | Where it stands | What our controls are designed to support |
|---|---|---|
| GDPR | In force across the EU/EEA. | Deployment in your environment, data minimisation by design and a documented list of data flows. |
| EU AI Act | Prohibitions and general-purpose AI duties already apply. Under the Digital Omnibus provisional agreement, stand-alone high-risk obligations are expected from 2 Dec 2027 and those embedded in regulated products from 2 Aug 2028, pending final adoption. | Logging, human-oversight workflows, transparency about sources, and data-governance documentation that support your deployer duties (Art. 9–15 and 26). |
| DORA | Directly applicable to financial entities since 17 January 2025; for them it takes precedence where it overlaps with NIS2. | On-premises or EU deployment, a documented exit strategy, information for your ICT third-party register, and recovery evidence (NatusAI Gemini on the roadmap). |
| NIS2 | Transposition varies by member state. Energy and telecom operators are essential entities. | Self-hosted operation inside your security perimeter, access control and an audit trail. |
| Solvency II · EIOPA | System-of-governance and outsourcing expectations for insurers using AI and external ICT providers. | The same controls (human oversight, logging, documented data flows and exit) as input to your governance and outsourcing documentation. |
| KVKK (Türkiye) | Amended in 2024: cross-border transfers rely on adequacy, standard contracts (the Board is notified within 5 working days) or binding corporate rules. | In-country or on-premises deployment, so no transfer is needed. |
| NIST AI RMF | Voluntary US framework with four functions: Govern, Map, Measure, Manage. | A mapping of our controls to its four functions, on request. |
| SOC 2 · ISO/IEC 27001 · ISO/IEC 42001 | Common procurement references for security and AI management. | Security and AI-management documentation on request. |
NatusAI supports your compliance programme; it does not replace your legal assessment or certify your systems. Regulatory facts last reviewed: October 2026.
Outside the EU? The same controls (data-flow map, exit plan, named approval and audit records) are our starting point for other regimes. Tell us which rules apply to you and we will go through them in a briefing.
Retention & responsibility
Deletion needs to account for every retained copy
Retention, legal holds, backups and exported derivatives need explicit policies.
The planned storage-group cryptographic boundary is not a promise of automatic per-person cryptographic erasure. A project must assess deletion and reclamation across its actual storage and recovery design.
Product architecture is not a compliance certification or a substitute for an organisation’s own legal and operational assessment.
Before you decide
Questions from risk, security and compliance teams
Direct answers. For the detail, ask for our governance pack or a session with your CISO and DPO.
Does our data leave our environment?
Only where you decide. Every data flow is listed and approved; a remote AI model is a recorded choice, not a default. On-premises deployment with local models keeps processing inside your walls.
Is NatusAI certified (ISO 27001, SOC 2)?
We do not claim any certification on this site. Ask us for our current certification status and our security documentation; we share them before any procurement step.
Is the NatusAI platform EU AI Act compliant?
No product can make that claim for you: compliance depends on how a system is used. Our controls (logging, human oversight, source transparency and data governance) are designed to support your duties as a deployer.
How do you help with DORA?
On-premises or EU deployment, a documented exit strategy, information for your ICT third-party register, and recovery planning in every engagement.
Who can approve what an AI does?
Your people. Consequential actions wait for a named approver. An AI agent cannot approve its own change or grant itself access.
What happens if we want to leave?
You keep your data, the models you chose and the applications we built. The exit plan is written at the start and lists what you receive and how you move.
Talk to our team
Bring your security and compliance questions
We will walk your CISO, DPO and risk team through the architecture, the data flows and the exit plan.
Or write to contact@natusai.com
