Summary for security reviewers
| Topic | Navora AI |
|---|---|
| Company | Navora AI LLC, a US company (Wyoming) |
| ChatDir API | For workflow and automation companies in the United States and South America; direct contract with Navora, no resale |
| ChatDir Workspace | For regulated organizations worldwide; in Europe and Switzerland hosted and operated by verified partner Victory Consulting GmbH |
| Model | ChatDir, Navora's own model, operated by Navora |
| Public AI providers | Requests are not forwarded to OpenAI, Anthropic or other public AI services |
| Training | Customer prompts and outputs are never used for training |
| Retention | No content retention by default; metadata only for billing and audit |
| Access | Non-public, invitation only; separate keys per customer, project and environment |
| Transport | TLS for all API traffic |
| Contracts | Master agreement, data processing agreement, API terms; business associate agreement for US healthcare customers |
Data flow
- Your workflow (n8n, Make, UiPath, your own code) sends a request over TLS to the Navora API with your company's key.
- The gateway checks the key, the limits and the model permissions, and records metadata: time, key, model, token counts.
- ChatDir processes the request on Navora's own servers in the United States.
- The response is returned to your workflow. Request and response content are discarded unless content logging has been enabled for that key in writing.
Data handling
No training
Prompts, documents and outputs are never used to train, fine-tune or evaluate models, except a customer's own fine-tuned model when the customer orders it in writing. A fine-tuned model is exclusive to that customer.
Retention
Content is not retained by default. Customers who need content logs for their own audit purposes can enable them per key; retention period and access are then defined in the agreement.
Metadata
For billing, abuse prevention and audit, we keep request metadata: timestamp, key identifier, model, token counts and status code. Metadata contains no prompt or output content.
Infrastructure and isolation
- Shared Private: pooled capacity with logical separation per customer by key, limits and data.
- Dedicated: capacity reserved for a single customer; separate environments per project on request.
- United States and South America: processing on Navora's own servers in the United States. Data residency requirements under local law, for example Brazil's LGPD, are agreed per project before go-live.
- Europe and Switzerland: ChatDir Workspace is hosted and operated by Navora's verified partner Victory Consulting GmbH, Geneva, on its own servers in Germany and Switzerland, under Navora's security and operating standards. Navora AI has no access to these servers or the data on them. The ChatDir API is not offered in Europe.
Access control and keys
- No public sign-up. Every customer is reviewed and admitted individually.
- Separate keys per customer, project and environment, with individual limits.
- Keys can be rotated or revoked at any time on request.
- Administrative access to production systems is restricted to authorized Navora personnel.
Contracts and compliance
We provide the documents your client's procurement team expects:
- Master service agreement and API terms, including acceptable use
- Data processing agreement
- Business associate agreement for US healthcare customers, signed before any protected health information is processed
- Completion of your client's security questionnaire
Incident response
If we become aware of a security incident affecting customer data, we notify affected customers without undue delay and within the time frames set by the applicable agreement and law, and we support their own notification obligations.
Request the security package
The security package contains this overview, a data flow diagram, contract templates and our questionnaire answers. We send it to prospective customers on request.
Request the Security Package