Navi AI Trust & Due Diligence Guide

Navi accesses and stores only the minimum data necessary to provide its services, including:

• Customer-uploaded transcripts and communication content
• Structured evaluation scores and associated explanatory reasoning
• Customer account and authentication information
• Metadata required for platform functionality, logging and system integrity

Customer data is logically isolated by tenant to prevent cross-customer access.

Customer data is securely stored in MongoDB Atlas with enterprise-grade security controls:

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Role-based access controls (RBAC)
• Network access restrictions and isolation

Data is retained only as long as necessary to provide the service or until deletion is requested.

Customers may request permanent deletion of their data at any time. Deletion includes stored transcripts, evaluation scores, explanatory reasoning and associated metadata.

Deletion is permanent and irreversible.

Customers may request export of their data or permanent deletion. Upon deletion request, Navi permanently removes customer data from all systems.

No Customer data is never used to train Navi's models or third-party models.

When Navi uses OpenAI's API for inference, data is processed solely for evaluation purposes and is not used for model training. Navi is actively implementing Zero Data Retention configurations. Customers retain full ownership of their data.

Yes. Customer data is never used for training or model improvement.

Yes, limited data is securely transmitted to subprocessors required to provide Navi's services. All transmissions are encrypted using TLS 1.2+.

Only the minimum transcript content necessary for evaluation is transmitted securely to OpenAI. Database storage providers store encrypted customer data. Hosting providers (Render and Vercel) process data temporarily during application execution but do not independently persist customer data outside Navi's database.

Navi minimizes transmitted data and uses secure encrypted communication for all external processing. Navi is actively implementing enhanced redaction and Zero Data Retention configurations to further strengthen data privacy protections.

Customers retain full ownership of uploaded transcripts, evaluation scores and analysis outputs. Navi does not claim ownership of customer data.

Yes. Customers may export their transcripts, evaluation scores and associated data upon request.

Generative AI is used to assist in analyzing transcript content and applying Navi's structured evaluation rubric. AI assists in interpreting communication patterns and producing rubric-aligned evaluation outputs. AI operates within Navi's structured evaluation framework and does not operate autonomously outside defined evaluation criteria.

AI evaluation operates only on customer-uploaded transcripts. Customers control which content is submitted for analysis.

Yes. Navi maintains audit logs for data access, evaluation processing, system activity and administrative actions. Evaluation outputs include stored explanatory reasoning supporting each score.

Yes. Each evaluation score includes structured explanatory reasoning describing how the score was derived based on Navi's evaluation framework. Evaluation outputs are traceable to the original transcript input.

Yes. Relevant system logs and evaluation data may be exported upon request.

Evaluation results are generated based on transcript content and Navi's structured evaluation rubric. Evaluation results are stored and may be reviewed for audit and verification purposes.

Navi is actively working toward SOC 2 Type II certification. Navi's infrastructure providers maintain SOC 2 Type II certification, including MongoDB Atlas, OpenAI, Vercel and Render (via SOC 2-compliant infrastructure).

Navi follows industry best practices aligned with GDPR principles, including data minimization, encryption, access controls and data deletion capability. Formal compliance certification is part of Navi's ongoing compliance roadmap.

Access is restricted to authorized engineering personnel only when necessary for system maintenance or support. Access follows least-privilege principles.

Access is controlled using role-based access controls (RBAC), multi-factor authentication (MFA) and infrastructure access restrictions.

System access permissions are restricted based on role requirements. Administrative access is limited and monitored.

AI processing occurs only through Navi's backend systems, which enforce authentication and authorization controls. AI cannot access data outside of authorized application scope.

Navi monitors systems for availability and security events and maintains incident response procedures. Incident summaries can be provided where available and appropriate upon request.

Navi uses enterprise-grade AI models accessed via secure API integration. Models are selected based on reliability, performance and security. Models are hosted by OpenAI and accessed via encrypted API connections.

Models are hosted by OpenAI and accessed via encrypted API connections.

Model updates are evaluated and tested prior to deployment to ensure consistency and reliability of evaluation outputs.

Safeguards include encryption at rest and in transit, access controls, tenant isolation and secure infrastructure. AI access occurs only through Navi's authenticated backend systems.

AI access occurs only through Navi's authenticated backend systems. Authentication and authorization controls are enforced at every layer of the application stack.

Navi's evaluation system is based on a structured grading rubric developed by subject matter experts and PhD-level researchers specializing in communication analysis. AI assists in applying this rubric consistently across transcript content.

Each evaluation includes structured scores and explanatory reasoning. Navi continuously evaluates system performance through internal validation, monitoring and ongoing product improvement.

Each evaluation includes structured explanatory reasoning supporting the assigned score, allowing users to review how evaluation criteria were applied. Navi operates as a decision-support tool and does not autonomously enforce decisions. Human review remains central to interpretation.

If transcript content does not sufficiently support evaluation criteria, the system may produce limited scoring or explanatory output. Users retain full authority to review and interpret evaluation results. Navi does not autonomously enforce decisions.

Navi provides structured evaluation scores along with explanatory reasoning describing how each score was derived. This enables transparent human review and interpretation. Navi is designed as a decision-support tool, not an autonomous decision-maker.

Navi's evaluation system operates within a structured rubric-based framework. Scores are generated based on defined evaluation criteria rather than unconstrained generative output. This structured approach improves consistency and reliability.

Yes. Deterministic logic is used for authentication, access control, data isolation, security enforcement and evaluation framework enforcement. AI assists in interpreting transcript content within this structured framework.

Navi operates as a decision-support system. Users review evaluation results and maintain full authority over interpretation and decision-making.

Navi continuously evaluates system performance and improves evaluation frameworks through internal review and monitoring.

In the event of a suspected security incident, Navi's response process includes:

• Triage and containment — limit access, disable affected credentials/services if needed
• Investigation using audit logs and system telemetry
• Remediation — patches, configuration changes, credential rotation
• Customer notification when applicable, including impact summary and corrective actions
• Post-incident review to prevent recurrence

Navi is formalizing these procedures into a written incident response plan as part of its security maturity roadmap.

Navi provides onboarding and implementation support that may include:

• Admin setup guidance and security configuration review
• Workflow onboarding and best practices for transcript evaluation
• Support for validation testing during trial periods
• Product support during rollout including feedback capture and iteration

Navi launched in December 2025 and has been in production use since then.

Navi's architecture is designed to be provider-flexible. If an AI model provider changes or sunsets a capability, Navi can migrate evaluation workflows to alternative model providers, maintain continuity by versioning evaluation prompts and framework logic, and validate behavior prior to rollout to preserve scoring consistency.

Navi can provide customer references upon request, subject to customer approval and confidentiality constraints.

Navi is building toward SOC 2 Type II compliance. Current security foundations include:

Navi uses version-controlled deployments and can roll back changes if issues are detected. Rollback procedures are used to restore prior known-good behavior quickly if needed.