Technology and information security
Where your third parties’ data lives
NAVA safeguards ID documents, social security enrollments, and contact details for hundreds of people who aren’t your company’s employees. That carries specific obligations under Law 1581 of 2012, Colombia’s personal data protection law.
This page is written for the IT or information security team that reviews the purchase. It only states verified product capabilities.
The fundamentals
Five verifiable fundamentals
- 01
100% web-based SaaS
No installation and no servers of your own. You access it from your browser and from the NAVA mobile app.
- 02
Cloud infrastructure on AWS and a TIER 3 data center
The platform is hosted on Amazon Web Services. Your company doesn’t manage servers or take on their maintenance.
- 03
Role-based access control
Profiles set granular permissions for each menu option. Each user accesses only what their role allows.
- 04
Audit logs
Every record created and every edit is logged with the person responsible and the date. Document decisions are traceable.
- 05
Law 1581 of 2012
Every third party and every visitor explicitly accepts the personal data processing policy before uploading any information.
Permissions
Internal access control is granular
You create profiles in the platform with permissions set one menu option at a time, and you assign one to each user. Whoever reviews documents doesn’t need to see the matrix setup, and whoever is at the gatehouse doesn’t need to see the contracts.
| Who logs in | What they can see | What they can’t |
|---|---|---|
| Your team | Whatever their profile allows, one menu option at a time | The options their profile doesn’t include |
| The third party | Their own elements, their own documents, and their own status | Information about any other third party |
| The gatehouse | The access check and the entry and exit log | The setup, the contracts, and the document review |
Your company defines the scope of each role; the product doesn’t set it for you.
Traceability
The lifecycle of a third party’s data
From the moment the data subject accepts the policy until their entry is logged, every stage leaves a trail with the person responsible and the date.
-
Policy acceptance
Explicit acceptance, before any information is uploaded
-
Upload
The file and the upload date
-
Review
The decision, the person responsible, and the date
-
Validity period
The expiration calculation and the status change
-
Entry check
The entry, the exit, and, if there was one, the exception with its justification
Personal data
Data about people who aren’t your employees
A contractor management system processes personal data about workers who don’t belong to your company: ID number, EPS (health insurer), ARL (Colombia’s occupational risk insurer), pension fund, blood type, emergency contact, and photo. The platform requires each data subject to explicitly accept the personal data processing policy before uploading any information, and that consent is recorded.
It’s a requirement of Law 1581 of 2012 and a practical condition: without the data subject’s consent, the information shouldn’t be in any system.
Support inside the platform
The platform includes a support button at the bottom of the screen that opens an incident form, without leaving the system or writing to a generic email address.
Frequently asked questions
Questions from the IT team
Do we need to install anything on our servers?
No. NAVA is a 100% web-based SaaS platform hosted on cloud infrastructure on AWS. Your company accesses it from the browser and from the mobile app, with no installation and no servers of your own.
Who can see our contractors’ information?
Only the users in your company whose profile allows it. Permissions are set for each menu option, and each third party sees only their own information.
Is there a record of who approved or rejected a document?
Yes. Every record created and every edit is logged with the person responsible and the date, including document decisions. That traceability is what backs up your evidence in an audit.
What happens when operations authorizes an entry without up-to-date documents?
The gatehouse can log an entry override, and the system requires stating who authorized it and why. The exception stays in the element’s history and shows up in the entry control report.
Does NAVA comply with Law 1581 of 2012 on personal data processing?
Every third party and every visitor explicitly accepts the personal data processing policy before uploading any information. The platform is hosted on cloud infrastructure on AWS, internal access is controlled with granular permission profiles, and every record created and every edit is logged with the person responsible and the date.
Can it integrate with our turnstiles or our physical access control system?
Access control works from day one with no integration needed: you look people up by ID number, license plate, or serial number, or scan the QR code on the ID badge from the NAVA app. Connecting to existing physical access control systems is assessed case by case during the technical survey, depending on the brand and model installed.
Technical demo
Does your IT team have more questions?
We can include your IT team in the demo and answer whatever they need to know about infrastructure, permissions, and data processing.
- Colombian software
- AWS infrastructure
- Law 1581 of 2012
- Support in Spanish