Security and data
Your data. Your perimeter. Your NaDIA.
An organisation’s data is an asset. NaDIA is designed to work only with the sources you authorise, in a controlled environment.
No single promise for everyone.
NaDIA is installed differently in each sector. What this page says about where data is kept applies only to the sector indicated.
Security and data
Five controls that stay with you.
External services or models
When external services or models must be used, data can be anonymised or pseudonymised first, according to the architecture and the policies defined by the client.
Data
NaDIA uses the data the client authorises.
Access
Each piece of information can be made available according to users, roles and permissions.
Sources
NaDIA works on the sources that have been defined and authorised, without exposing the organisation’s knowledge indiscriminately.
Processing
The architecture can be configured to keep data and processing in controlled environments.
Traceability
Activity can be monitored and traced according to the organisation’s policies.
Three ways to deploy NaDIA.
NaDIA can run in a private cloud, on-premise or in dedicated environments. The three options below are those documented for municipalities and cantons. Law firms and engineering firms each have their own installation, described in the “Sector by sector” section.
Options documented for
Municipalities and cantonsStandard (cloud)
Documents temporarily in Native Digital’s cloud systems; processing in the cloud, encrypted. Quick activation, scalability, simple management.
On-premise
Documents on your authority’s servers; processing in the cloud, encrypted. Direct control over the data and deep integration with existing systems.
Dedicated server
Documents on a dedicated server at your premises; processing exclusively on the local server. No data transferred to the cloud.
Sector by sector.
Where the documents are, where processing takes place, what goes out and what is not stored. For healthcare we state the governance measures.
Law and fiduciary firms
01 / 04| 01Where the documents are | On a dedicated computer, in the firm’s office. |
|---|---|
| 02Where processing takes place | On that computer: language model, search engine and documents. |
| 03What goes out | Nothing. The internet connection is used only at night, to download the updated laws and rulings from public sources. |
| 04What is neither stored nor used for training | No cloud service receives your questions or your documents. |
Engineering firms
02 / 04| 01Where the documents are | On the firm’s network share, accessed read-only. Extracted texts, indexes, conversations and attachments on a server inside the firm. |
|---|---|
| 02Where processing takes place | The heavy work (OCR, extraction, indexing) on the firm’s server. The website (accounts, permissions, history) on a server in Switzerland run by Native Digital. NaDIA’s model and AI services in Switzerland. |
| 03What goes out | Only the text fragments and extracts needed to search or to answer, together with questions and voice audio, sent to NaDIA’s services in Switzerland. |
| 04What is neither stored nor used for training | Those fragments and extracts are neither stored nor used for training. The website writes none of the firm’s files or text to its own disk. |
Municipalities and cantons
03 / 04| 01Standard (cloud) | 02On-premise | 03Dedicated server | |
|---|---|---|---|
| 01Where the documents are | Temporarily in Native Digital’s cloud systems. | On your authority’s servers. | On a dedicated server at your premises. |
| 02Where processing takes place | Processing in the cloud, encrypted. | Exclusively on the local server. | |
| 03What goes out | The text to be processed, encrypted. Personal data is anonymised in Switzerland before an external model processes the text. | Nothing: no data leaves your authority. | |
| 04What is neither stored nor used for training | In standard configurations no personal data is stored, except authorised anonymised data. | No data transferred to the cloud. | |
- 01Where the documents are
Standard (cloud)
Temporarily in Native Digital’s cloud systems.
On-premise
On your authority’s servers.
Dedicated server
On a dedicated server at your premises.
- 02Where processing takes place
Standard (cloud)
Processing in the cloud, encrypted.
On-premise
Processing in the cloud, encrypted.
Dedicated server
Exclusively on the local server.
- 03What goes out
Standard (cloud)
The text to be processed, encrypted. Personal data is anonymised in Switzerland before an external model processes the text.
On-premise
The text to be processed, encrypted. Personal data is anonymised in Switzerland before an external model processes the text.
Dedicated server
Nothing: no data leaves your authority.
- 04What is neither stored nor used for training
Standard (cloud)
In standard configurations no personal data is stored, except authorised anonymised data.
On-premise
In standard configurations no personal data is stored, except authorised anonymised data.
Dedicated server
No data transferred to the cloud.
Healthcare
04 / 04- 01Access control by role and department, with IdP/SSO integration
- 02Segregation by technology and supplier
- 03Complete audit trail: who, what, when
- 04Document retention policies
- 05Encryption in transit and at rest
- 06Backup and disaster recovery
- 07Designed for alignment with the FADP and the GDPR
FADP and GDPR, by design.
Documented for engineering firms and for healthcare.
Technical measures.
The measures documented for engineering firms, for healthcare and for municipalities and cantons: each with the sector in which it is documented.
| Measure | Engineering firms | Healthcare | Municipalities and cantons |
|---|---|---|---|
| No open inbound port: an encrypted tunnel, opened from inside the firm | Documented | ||
| Secure integration with your authority’s information systems | Documented | ||
| Archive and ERP read-only; the ERP limited to a closed list of tables | Documented | ||
| Encryption in transit and at rest | Documented | ||
| Encryption of data during processing | Documented | ||
| Activity log: who, what, when | Documented | Documented | |
| Retention policies set by you | Documented | Documented | |
| Backup and disaster recovery | Documented |
No open inbound port: an encrypted tunnel, opened from inside the firm
Secure integration with your authority’s information systems
Archive and ERP read-only; the ERP limited to a closed list of tables
Encryption in transit and at rest
Encryption of data during processing
Activity log: who, what, when
Retention policies set by you
Backup and disaster recovery
Access and sessions.
Credentials, sessions and connections: the measures documented for engineering firms and for law firms.
Mandatory HTTPS, protected cookies, defences against forged requests and external scripts
Each firm sees only its own documents, with separate permissions for administrator, professionals and assistants
Encrypted connection from the firm’s computers, tablets and phones
Passwords and sessions
Engineering- 12
- Minimum characters
for every password - 5
- Attempts, then
access is locked - 30
- Minutes of inactivity,
then the session closes
Passwords hashed with Argon2id
Does your IT manager have questions?
Let us arrange a technical session on your case: architecture, data flows and requirements.