One unified governance plane for every system your data lives in — and every tool that wants to read it.
It lives in 28 SaaS apps, half of them adopted bottoms-up, none of them wired to a single source of truth — and every one of them now sits behind an API that an AI vendor wants to call on Monday morning.
IT, Security, Legal, and Data Ops all touch it. None of them own it.
| Step | Owner | What actually happens | Time |
|---|---|---|---|
| Vendor security review | Security | SIG, SOC 2 review, risk score | ~10d |
| DPA + redlines | Legal | Email threads, Word docs | ~14d |
| Scope which data | Data / IT | "Just give them the #public channels" | ~7d |
| Provision OAuth | IT, per source | Admin grants in 6 different consoles | ~5d |
| Monitor + audit | Nobody | There is no audit trail | ∅ |
| Total per vendor | …and you'll repeat it next month for the next tool | 36 days |
Connect your sources once. Define policy in one place. Approving a new AI vendor — or letting an internal team build against your data — becomes a single click, fully audited.
DAP — the Data Access Protocol. Open spec. Apache-2.0. A common contract between data producers, identity providers, and AI consumers.
nalta.ai is the hosted, enterprise-ready reference implementation. The spec, the SDKs, and the broker daemon are open source — companies can self-host or run them on us.
# grant a coding agent read-only access # to public repos + linear tickets [grant] consumer = "cursor.ai" purpose = "engineering · code-completion" expires = "2026-08-01" [scope.github] visibility = "public" actions = ["read"] [scope.linear] teams = ["eng", "infra"] actions = ["read"] exclude_labels = ["hr", "legal"] [policy] mask_pii = true audit = "stream://nalta.audit"
Once a company's data graph lives in nalta, any approved internal team — or external builder — can query against it under the same policy.
Like GitHub turned source code into a substrate that thousands of apps build on, nalta turns enterprise data into one.
Every function — sales, support, eng, legal — is buying its own AI vendor. Each one wants enterprise data on day one.
Identity providers stop at "who logged in." Nobody governs which docs, channels, or records a vendor can read.
Anthropic's MCP proved a common contract can ship. The market is ready for an open, governed standard above it.
| Player | Identity | Source connectors |
AI consumer governance |
Open protocol |
Programmatic data plane |
|---|---|---|---|---|---|
| Okta / JumpCloud | ● | ○ | ○ | ○ | ○ |
| Glean / Guru | ○ | ● | ◐ | ○ | ○ |
| Collibra / Atlan | ◐ | ◐ | ○ | ○ | ◐ |
| Anthropic MCP (spec) | ○ | ◐ | ○ | ● | ◐ |
| Hosted ETL (Fivetran, etc.) | ○ | ● | ○ | ○ | ○ |
| nalta.ai | ● | ● | ● | ● | ● |
Every wave of computing
gets the access layer
it deserves.
Identity got Okta. Networks got Cloudflare. Data got Snowflake.
AI access — the last unsolved primitive — gets nalta.