01
Cloud SaaS
Fully managed. First report in an afternoon.
Your network
Git
repository content
Navigara cloud
CollectorAPIDashboardPostgreSQL
Navigara operates every component and processes your data under a data processing agreement.
Quickstart →→Navigara · Trust·Security
Your data, your environment, your rules.
Choose managed cloud, a collector in your network, or full on-premises deployment. SOC 2 Type II audited, whichever you choose.
SOC 2 Type IIGDPRReport and DPA on requestDeployment review
Run by banks, a cybersecurity vendor, and regulated fintechs
02Most common
Collector in your network
Analysis inside your perimeter, dashboard in the cloud.
Your network
GitCollectorLLM endpoint
structured results only
Navigara cloud
APIDashboard
The collector clones and analyzes locally, and holds one outbound stream. Source code never crosses.
On-prem collector →03
Full on-premises
Complete data sovereignty, air-gap included.
Your network
GitCollectorLLM endpointBackendDashboardPostgreSQL
nothing crosses
Navigara cloudnot connected
Every component runs on your side. The licence is verified offline and there is no telemetry.
Full on-premises →01The exact list
A fixed list of outbound connections. No inbound ones.
Hand this exact connection list to your security team: it covers source code security, derived metrics, and the model endpoint that handles source code processing.
| Destination | Component | Purpose |
|---|---|---|
| Your Git host | Collector | Cloning and pull request data |
| Your LLM endpoint | Collector, backend | Commit analysis and summaries |
| Your issue tracker | Collector | Alignment scoring |
| Your identity provider | Backend | Single sign-on |
| app.navigara.com:443 | Collector | Work assignment. Hybrid only, never on-prem |
# on-prem collector · what crosses the boundary
commit.metadata✓ shape, author, timestamps
review.activity✓ approvals, comments, timings
analysis.scores✓ ETV per developer
knowledge.graph✓ features, layers, dependencies
tracker.linkage✓ issue keys, objective mapping
source.code✗ cloned and deleted in your network
secrets / .env✗ never read
git.credentials✗ decrypted in memory, on your host
→ residency: your VPC / your region
The LLM endpoint is your processor
Analysis sends commit messages and changed lines to the endpoint you configure, under your own account, never to Navigara. If code must not leave the network, host the model inside it: any OpenAI-compatible endpoint works.
| Operated by | Cloud SaaS | Collector on-prem | Full on-premises |
|---|---|---|---|
| Collector host and network | Navigara | You | You |
| LLM endpoint and residency | Navigara | You | You |
| Proxy, TLS and headers | Navigara | Navigara | You |
| Database and backups | Navigara | Navigara | You |
| Root admin key custody | Navigara | Navigara | You |
| Credentials, SSO and tokens | You | You | You |
02Controls
Every mode ships the same controls, switched on.
Read-only, always
Navigara never writes to your repositories or trackers. Minimum scopes, on a service account you own.
Git tokens we cannot read
Encrypt each token against your collector’s key. We store the ciphertext; the collector decrypts it in memory.
Docs →No inbound ports
Every component dials out. Only your own reverse proxy publishes a port.
SSO, SCIM, four roles
SAML and OIDC through Okta, Entra or Google. Passwords off by default. SCIM 2.0 syncs the directory.
Audit log for your SIEM
One structured record per privileged operation: who, what, which resource, outcome, client address.
Signed images, with an SBOM
Every release is cosign-signed with build provenance. Verify it, then pin by digest.
Hardened by default
Non-root, read-only filesystem, no Linux capabilities, and segmented container networks.
One VM to operate
A full deployment is Docker Compose on a single Linux VM, plus managed PostgreSQL with pgvector.
Docs →SOC 2 Type II · GDPR
Navigara is SOC 2 Type II audited and operates under GDPR. The audit report, the current policy set and the DPA are available on request, so your security team can review them before the first call.
03Before every rollout
Source code security questions.
- How does source code security vary by deployment?
- It depends on two choices: deployment and model endpoint. A collector analyzes repositories inside your network and sends structured results to Navigara Cloud. Source code processing also sends changed lines to the LLM endpoint you configure. Run source code processing fully on-premises with a local model, and keep those paths inside your environment.
- Does source code processing require inbound ports?
- No. Every component dials out, and the collector opens no listening port. On full on-premises, your own reverse proxy publishes the application port. Check the outbound list above in your source code security review, including the model endpoint for source code processing.
- Can we keep source code processing air-gapped?
- Yes, with a full on-premises deployment and a model hosted inside your network. The license is verified offline. If you point the deployment at an external model, that provider handles source code processing, which changes your source code security review.
- Who can access our self-hosted source code processing environment?
- Your administrators, and Navigara support only if you leave its access in place. Builds include a root login key bound to the hostname. It needs network reachability, your host audits every use locally, and one configuration flag removes it. Decide on that flag during your source code security review.
- Does source code processing train models on our code?
- Navigara sends analysis to the LLM endpoint you configure, under your own account. Whether that provider trains on it depends on your agreement with them, so check their retention and training settings and record the endpoint in your source code security review.
- What data belongs in a source code security review?
- Engineer identities, commit and tracker content, AI usage, derived metrics, and any changed code sent to a model. Confirm processing roles and the DPA for your deployment. Tickets can hold customer names and incident details, so put tracker content in scope when you review source code processing.
- How does retention affect source code security?
- Retention is set per data class. AI usage records default to 14 days, raw webhook payloads to 90 days, and prompt capture is off by default. Your model provider keeps its own retention, so list it separately in the source code security review.
- What evidence supports our source code security review?
- The SOC 2 Type II report, the current policy set, and the DPA, all available on request. Check the report’s audit scope and date against the deployment you plan to run. Then walk through source code processing destinations and access settings with us on a technical call.
→Start here
Bring your security team
to the first call.
An hour on your architecture review now beats a blocker in procurement. Come with the questionnaire. We can walk through the deployment, SOC 2 report, policy set and DPA with you.