Controls that check themselves
Connect your code host and identity provider, and Nata checks the controls they can prove, every day, with the result saved as evidence.
The security team’s platform, starting with GRC.
Nata is one hosted app for your security work. It starts with SOC 2: it checks your controls against the tools you already use, keeps the evidence your auditor asks for, and tells you what needs fixing.
What Nata does today
A control library mapped to SOC 2, with the checks your tools can prove automated and the rest tracked in one place.
Evidence that stays fresh
Upload what can’t be automated. Nata tracks when each piece goes stale, so nothing quietly stops counting.
Policies people actually accept
Write and version your policies in Nata, then send each person a link to read and accept them. No account needed.
People and training
Keep your roster and training records in one place, and see who is fully compliant at a glance.
Tasks that close themselves
When a check fails, Nata opens a task for the account that needs fixing, and closes it once the fix shows up.
Ready for your auditor
A read-only auditor role, a full activity log, and a clear “not applicable” record with the reason and who decided.
Checked for you, every day
A few of the checks Nata runs against your connected tools:
- Default branches are protected, with required reviews and status checks (GL-01, GL-02, CM-01)
- Everyone in your GitHub organization uses two-factor authentication (AC-02)
- Every directory account has MFA, and no one has been inactive for 90 days (AC-02, AC-01)
- People who left no longer have accounts (HR-05)
- Every account belongs to a person on your roster (AC-03)
- Vulnerabilities are fixed within their deadline, and code scanning is on (VM-01, SD-03)
- Security training is current for everyone on the roster (TR-01)
Integrations
Nata only reads from the tools you connect. It never changes your settings.
GitHub
Branch rules, code review, required checks, organization 2FA, code scanning, Dependabot and secret scanning.
GitLab
Branch protection, merge request approval rules and project membership.
Google Workspace
MFA enrollment, inactive accounts, leavers who still have access, and accounts nobody owns.
Okta
The same directory checks, plus sign-in policies: MFA required, password standard, idle session timeout.
Microsoft Entra ID
The same directory checks for Microsoft 365 organizations.
Slack
Alerts in a channel when something needs attention.
Amazon Web ServicesComing soon
Google CloudComing soon
Microsoft AzureComing soon
JamfComing soon
Microsoft IntuneComing soon
KandjiComing soon
Where Nata is going
Compliance is the first part of Nata, not the whole of it. Over time, Nata will bring more of a security team’s work into the same app, on the same foundation.
Talk to us
Email us to see Nata on your own stack, ask about pricing, or tell us what your security team needs.