Enterprise security for engineering data.
Nyotta is designed for sensitive engineering workflows. We combine controlled access, tenant separation, traceable outputs, and expert approval so teams can use AI without losing ownership of the decision.
SOC 2 TYPE IISecurity criterion · Report under NDAControl begins with how the product is designed.
Six properties that hold whether or not anyone is watching, because they are built into how the system runs rather than promised in a policy.
Tenant-scoped data
Customer data and learned context remain isolated to the authorized environment.
Encryption
Data is encrypted in transit and at rest.
No cross-tenant training
Customer data is not used to train models for other customers.
Least-privilege access
System and personnel access is limited to the scope required for the approved workflow.
Expert approval
Generated work remains reviewable before it is finalized or written to downstream systems.
Traceability
Material outputs retain source support and review state.
Who can reach it, and what happens to it.
Access is scoped to the people and systems the work requires. The data itself stays under the terms you signed.
Access control
Role-based access control
Multi-factor authentication
Single sign-on and SAML
Customer-approved system scopes
Review and approval permissions
Data governance
Process the documents and records required for the approved use case.
Use customer data only to deliver and improve that customer's authorized workflow, subject to the governing agreement.
Apply contractual retention and deletion requirements.
Provide current subprocessor information through the security review process.
Evidence for the teams responsible for trust.
SOC 2 Type II report
Vulnerability management
Independent penetration testing
Security incident response
Backup and recovery controls
Architecture and data-flow review on request
Our current report covers the Security criterion. We do not claim Availability or Confidentiality coverage unless a signed report explicitly includes them.
Bring your security team into the conversation.
We can review architecture, data flows, access requirements, and available assurance documentation for your deployment.
Questions from security reviewers.
Is Nyotta SOC 2 Type II certified?
Yes. Nyotta holds a CPA-signed SOC 2 Type II report covering the Security Trust Services Criterion, with no exceptions across the tested controls. The audit was performed by an independent firm against a defined observation period, and the report is available under NDA as part of your security review. We also complete customer security questionnaires in whatever format your team uses.
Is our data used to train AI models?
No. Your data is never used to train models shared with any other customer or released publicly, and that is a contractual commitment rather than a policy setting. Deployment is single tenant, so your material sits in its own isolated environment instead of pooled with other customers. On termination you receive your data and all platform output as a complete export.
Where does our data go when we upload an RFQ?
Files are stored in Nyotta's Google Cloud environment. Data is encrypted in transit and at rest. The application database is hosted on Supabase, which is the one subprocessor outside Google Cloud. A full subprocessor list comes with the security package.
Can Nyotta run single-tenant or in our own cloud?
Single tenant is the default. Your data is held in its own isolated environment on a major cloud platform, not pooled with other customers. Access runs on SSO and SAML with multi-factor authentication and role-based control, and every read from and write to your systems is logged and available to you. All material you provide remains your property.