Cloud Edition See On-Premise Edition →

Natalia Analytics security GDPR compliance, encryption, RBAC

Reference for CISOs and DPOs: data localization, encryption, pseudonymization, RBAC, audit, retention, breach notification, compliance roadmap.

✅ EU hosting ✅ GDPR compliant ✅ DPA art. 28 ✅ TLS 1.2+ encryption ✅ Annual pen test ⏳ SOC 2 Type I (Q4 2026) ⏳ ISO 27001 (2027 roadmap) ✅ Breach notif < 72h ✅ Immutable audit log
  • EU data only
  • Encryption at-rest + in-transit
  • Phone pseudonymization
  • DPA art. 28 signed
  • Breach notif < 72h

Data localization

CDR data is hosted exclusively in the European Union (Belgium): managed relational storage and managed object storage, EU residency guaranteed. No replica outside the EU. Application logs stay in the same region (retention periods are detailed in the Data retention section).

Encryption

At-rest

  • Agent VM: vTPM-sealed key when available, salted cryptographic derivation as fallback, industry-standard encryption (NIST SP 800-175B algorithms) for configuration and disk buffer.
  • Cloud: transparent encryption on managed datastores, master key held in a certified key management service (KMS) physically separated from the datastore.

In-transit

  • TLS 1.2 minimum, TLS 1.3 preferred.
  • Agent → API verifies the certificate chain, no skip option.
  • Managed PKI with automated certificate rotation.

Phone number pseudonymization

At ingestion, each phone number is replaced by a per-tenant cryptographic pseudonym via salted derivation. Only the last 4 digits stay in clear for UI display.

The per-tenant secret is stored encrypted ; the master key sits in a certified KMS physically separated from the datastore.

Break-the-glass

Phone-reveal access requires a justification motive, lands in the immutable audit log, and triggers an alert to the tenant admin.

RBAC — three roles

Permission Viewer Analyst Admin
cdr.read✓✓✓
cdr.export—✓✓
cdr.reveal_phone——✓
api_key.manage——✓
user.manage——✓
audit.read——✓

Admin authentication (MFA)

MFA mandatory on all cloud administrator accounts. Production infrastructure access transits a hardened bastion with short-lived credentials and full session recording.

Multi-tenant isolation

Strict logical isolation per tenant at every layer (API, datastore, object storage, audit log). Cross-tenant access is impossible by construction and validated on every deployment by automated isolation tests.

For the functional side — organization hierarchy, agencies and sub-agencies, role scope and sub-agency creation from the dashboard — see the multi-tenant management page.

Agent appliance hardening

Lightweight virtual appliance, hardened image aligned with CIS Benchmark Level 1: minimal attack surface, no user shell, SSH disabled, no inbound network exposure beyond the encrypted outbound tunnel to the cloud.

Service continuity (RTO / RPO)

Regular backups, quarterly restoration drills. RTO 4h / RPO 24h. Backups encrypted, stored in the same EU region, never leave the European Union.

Audit log

Every admin action lands in an immutable audit log: who, what, when, source IP, user-agent, request ID. CSV export from the dashboard. Retention: 13 months (12 months + 1 month overlap for audits).

Data retention

Natalia commits to maximum retention periods per data category. Each period rests on a defined legal basis under the GDPR.

Data category Maximum retention Legal basis
Call audio recordings 12 rolling months Legitimate interest (case review, quality)
Transcripts and analyses 24 months Legitimate interest / contract performance
Technical logs 90 days Legitimate interest (security, debugging)
Anonymized aggregated statistics Unlimited Outside GDPR scope (no re-identification possible)

Deletion on request

On a deletion request, the data becomes immediately inaccessible and Natalia commits to a definitive erasure within 30 days.

DPA and subprocessors

  • GDPR art. 28 DPA signed electronically at subscription.
  • AI engine: GDPR-compliant AI engine, no transfer of nominative personal data outside the EU (pseudonymization applied before any AI processing).
  • Subprocessors list: an up-to-date subprocessors registry is available to customers under NDA upon request to [email protected].
  • 30 days notification before any change to the subprocessor list.

Breach notification

GDPR article 33 commitment: notification within 72 hours of awareness of a personal data breach. Contact: [email protected].

Procedure: isolation of the compromised perimeter, forensic snapshot, CNIL notification, customer communication, public postmortem within 14 days.

Compliance roadmap

API key rotation

API keys rotate from the admin portal. During rotation, previous and new keys both stay valid for a 7-day overlap window, enabling zero-downtime client migration.

Email to the tenant admin at rotation and 24h before the overlap window closes.

Data retention — frequently asked questions

How long does Natalia keep call data?
Audio recordings are kept for up to 12 rolling months, transcripts and analyses for up to 24 months, and technical logs for 90 days. These are maximum retention periods, specific to each data category.

Can I review a call that is several months old?
Yes. Transcripts and analyses stay available for 24 months, which covers case follow-up over time. Replaying the original audio remains possible for 12 rolling months.

What happens to a conversation I ask to delete?
As soon as you request deletion, the conversation becomes immediately inaccessible. Natalia commits to its definitive erasure within 30 days.

What legal basis do these periods rely on?
Retaining recordings, transcripts and analyses relies on legitimate interest and contract performance (case review, service quality). Technical logs fall under legitimate interest related to security and debugging.

Do these periods apply to aggregated statistics?
No. Aggregated and anonymized statistics allow no re-identification: they fall outside the scope of the GDPR and can be kept without a time limit.