Natalia On-Premise Contractual Modes
Three modes based on your sovereignty requirements. Choose at installation, adjustable later.
Canonical matrix
| Criterion | Disconnected Strict Maximum sovereignty | + 72h Support Remote support on demand | Connected Standard SaaS, AI included |
|---|---|---|---|
| Outbound connectivity | None | 72h support tunnel, client-triggered only | Permanent (encrypted) |
| GDPR art.28 DPA | Not required (pure software publisher) | Light Support-DPA | Full SaaS art.28 DPA |
| Declared sub-processors | None | Natalia support only (rolling 72h) | Full list on request |
| Data that leaves | None | Anonymized support logs only | Metrics + assisted AI |
| Conversational AI | Local only (MCP via your LLM) | Local only | Available (on-demand assisted AI) |
| CISO sales cycle | -3 to -6 weeks (no DPA) | Standard | Standard SaaS |
| Typical use case | OIV, banks, mutuals, healthcare, defense | Regulated mid-market needing remote support | Standard SaaS, MCP/AI included |
How to choose?
Three questions, in this order:
1. Are you OIV/OES, or do you have a strict isolation requirement (NIS2, SecNumCloud)?
→ Disconnected Strict. No outbound, no DPA, no sub-processor.
2. Do you need remote support with an SLA?
→ + 72h Support. Client-triggered outbound tunnel, light Support-DPA, anonymized logs only.
3. Do you want conversational AI activated out of the box?
→ Connected. Standard SaaS billing, art.28 DPA, on-demand assisted AI.
Migration between modes
Migration between modes is possible without reinstalling and without migrating data. The mode is a configuration parameter, not an architectural fork.
- → Strict → +72h: amendment to enable Support-DPA, customer-controlled tunnel activation.
- → +72h → Connected: art.28 DPA signature + activation of permanent outbound (configurable IP/proxy filtering).
- → Connected → Strict: contract termination of SaaS clauses, deactivation of outbound, data remains on the appliance.