Your data stays in your workspace
Every piece of data you upload is isolated to your workspace. No other customer can see it. Access controls ensure that only authenticated members of your workspace with the appropriate role can view or act on your data.
What Nagata stores
| Data type | What's stored |
|---|---|
| Spend transactions | Vendor name, amount, date, category, department |
| AI usage events | Provider, model, workflow, tokens, cost, timestamp |
| Contract documents | The uploaded file and extracted field values |
| Audit trail entries | Who did what, when |
| Member information | Email, display name, role, join date |
Nagata does not store passwords in plaintext. Authentication is managed through a secure third-party auth provider.
How AI is used, and where it isn't
Nagata's AI features run on Anthropic's Claude models. They are:
- Contract extraction. Pulls renewal dates, notice periods, contract value and seat counts from contracts you upload. Every extracted field is confirmed by a person before it affects any calculation.
- Chat assistant (Intelligence and above). Answers questions about your workspace by calling read only lookups scoped to your workspace, plus web search for market context. It cannot change your data or reach another workspace.
- Procurement research and policy import. Researches tools against your procurement policy using web search, and turns a pasted policy document into structured fields you review before saving.
- Support assistant. Helps you describe an issue so it can be filed as a ticket. It sees only what you type into it.
Every plan includes a monthly AI activity budget for these features. See Limits and known gaps.
Safeguards in place:
- Anthropic does not train models on your data, and neither do we
- Only the text a feature needs is sent, and contract text is capped per request
- Prompts and contract text are never written to logs or audit trails
- Content from documents and web pages is treated as untrusted input, never as instructions
Recommendations, alerts, ROI and reports do not use AI. Those rules are deterministic, and every finding shows the formula and data behind it.
For the full picture, see our security overview and privacy page.
Audit trail
Every significant action in Nagata is logged: vendor changes, recommendation decisions, alert acknowledgments, member invitations, and settings changes. Audit logs record who acted, what they did, and when — but never store raw document content.
Audit logs are visible to Owner, Admin, Finance, and IT roles.
Access control
- Cross-workspace access is impossible by design — guessing another workspace's URL returns a not-found page
- API keys are tied to your workspace and can be revoked at any time
- API integrations are blocked from sensitive actions like approving recommendations
Compliance questions
Our security overview and privacy page cover most vendor review questions. If you need more for a vendor review or compliance audit, email security@nagata.ai.