Skip to main content
Natural holds sensitive data and moves money, so security is built into how that data is protected and how every action is authorized.

​
Data protection

  • All API traffic is encrypted in transit with TLS 1.3.
  • Data at rest is encrypted with AES-256 using dedicated AWS KMS keys that rotate automatically.
  • The most sensitive identifiers, such as Social Security and tax ID numbers and bank account numbers, are additionally encrypted at the field level with keys held outside Natural’s systems, so their plaintext is never readable from Natural’s database.

​
Authentication and access

  • Access uses API keys, agent keys, or OAuth for MCP clients, and every credential is limited to scopes that can never exceed the permissions of the party that issued it.
  • Keys are high-entropy random values, shown once when they are created and stored only as one-way hashes.
  • OAuth uses the 2.1 flow with PKCE and short-lived access tokens, and reusing a rotated refresh token revokes the session.
  • Access tokens are signed by AWS KMS, and the signing key never leaves KMS.
See Authentication for how credentials and scopes work.

​
Agent authority

An agent can act only with the permissions and limits a party grants it, and Natural enforces that grant on every request.
  • A party grants an agent specific permissions and spending limits, and lowering a limit or removing a permission takes effect immediately.
  • A payment that would exceed a limit is held for approval rather than dropped.
  • Every agent payment records the agent’s verified identity and a run identifier, so it traces back to the exact agent and run that made it.
  • Permissions and limits are enforced on Natural’s servers rather than in your code, so a compromised or misbehaving agent cannot exceed what it was granted.