Skip to main content
NEW: Cloud Hardening for 2027.

Cyera + Native

Turn Cyera data classifications into cloud boundaries that hold.

Cyera finds and classifies the sensitive data across your cloud. Native matches each classified datastore to the right cloud resource, evaluates the impact of the controls that data needs, and enforces them through provider-native controls across AWS, Azure, Google Cloud, and OCI. When Cyera’s classifications change, Native updates enforcement on the next sync.

Better together

Cyera

Find and classify sensitive data

Native

Map each classification to the controls its data zone requires

AWS / Azure / Google Cloud / OCI

Evaluate impact, then enforce provider-native controls

  • Turn a Cyera classification into an enforced cloud boundary instead of a ticket or a manual handoff between teams.
  • Define once what sensitive data requires and enforce it across four clouds.
  • See the likely production impact before a boundary is enforced.
  • Keep enforcement aligned as Cyera’s classifications change.

Cyera finds the data. Native enforces the perimeter.

The people who classify data in Cyera usually aren’t the people who own cloud controls. Without the integration, a classification lands in a queue and someone on the cloud or platform side has to turn “this store holds regulated data” into a boundary, cloud by cloud. Then the data gets copied, replicated, or moved into a new account or region, and the boundary has to be rebuilt around it. With Cyera connected, the classification itself activates the control set your team already approved.

Cyera
DATA SECURITY TEAM

Decides which data is sensitive

Discovers datastores across accounts and regions, classifies what’s inside, and rates how sensitive it is.

Native
CLOUD AND PLATFORM TEAM

Decides what sensitive data requires

Defines the control set once, reviews the impact before anything changes, and owns enforcement in each cloud.

classification + severityis the handoff. No ticket, no per-cloud rewrite.

See classified data alongside the controls protecting it

Native shows Cyera classifications in the same views your team uses to understand accounts, zones, and policies. You can see which datastores hold sensitive data, how severe each classification is, and which controls are active around it.

The controls classified data gets

You define once what sensitive data requires. Cyera decides which data qualifies. Native applies the control set for that data zone, so nobody hand-writes controls per store or per cloud.

  • Encryption at rest

    Data in classified stores stays encrypted at rest.

  • Customer-managed keys

    Encryption uses keys your organization controls.

  • TLS enforcement

    Connections to classified stores have to use TLS.

  • Block anonymous and public access

    Closes anonymous and public access paths to the store.

  • Restrict destructive operations

    Limits deletes and other destructive actions on classified data.

  • Audit logging

    Keeps a record of who and what accessed the store.

Enforced through each provider’s own controls

Object storage, managed databases, and analytics services

AWS

  • Service control policies
  • Resource control policies
  • S3 Block Public Access
  • KMS key and bucket policies

S3 · RDS · DynamoDB · Redshift

Azure

  • Azure Policy
  • Key Vault customer-managed keys
  • Storage account access settings
  • Diagnostic settings

Blob Storage · Azure SQL · Cosmos DB

Google Cloud

  • Organization policies
  • VPC Service Controls
  • IAM deny policies
  • Cloud KMS (CMEK)

Cloud Storage · Cloud SQL · BigQuery

OCI

  • Security Zones
  • IAM deny policies
  • OCI Vault keys
  • Compartment policies

Object Storage · Autonomous Database

How the integration works

Cyera classifies a datastore

Cyera discovers the datastore, classifies the data inside it, and assigns a severity.

Native matches it to your cloud inventory

Native matches the classification to the resource in its multi-cloud inventory using the cloud account ID and datastore UID, then tags the resource with its classification and severity.

Native evaluates the impact

Before a control is enforced, Native evaluates its impact on the resources and workloads that depend on that datastore.

Native enforces the control set

Native applies the control set for that data zone through provider-native APIs across AWS, Azure, Google Cloud, and OCI.

Enforcement follows the data

When Cyera updates or adds a classification, Native re-ingests it and adjusts the active controls on the next sync.

What this looks like in practice

Take a public S3 bucket that Cyera classifies as Critical. The same bucket serves a production application, so cutting off public access carelessly could take that application down.

s3://payments-exports-prodCriticalPublicServes production traffic
  1. CYERA

    Classifies the bucket as Critical

    PII, financial data, credentials, and health records.

  2. NATIVE

    Matches and tags it

    Finds the bucket in your inventory by cloud account ID and datastore UID, and tags it with the classification and severity.

  3. NATIVE

    Evaluates the impact first

    Shows the team exactly what public access is doing for the production app, so they can close the boundary without breaking what’s running.

  4. NATIVE

    Enforces the control set

    Encryption at rest, customer-managed keys, TLS, blocked anonymous and public access, restricted destructive operations, and audit logging, through AWS’s own controls.

  5. CYERA

    Updates the classification later

    Native picks up the change and adjusts the active controls on the next sync.

Cyera takes the bucket from unknown to classified, and Native takes it from classified to enforced. The same path covers managed databases and analytics services across AWS, Azure, Google Cloud, and OCI.

Set up the Cyera integration

Step 1: Create API credentials in Cyera

Generate a Client ID and Client Secret in Cyera, following Cyera’s own documentation. Cyera is the source of truth for its setup flow, so we don’t reproduce it here. Cyera only shows the Client Secret once, so copy it somewhere safe before you leave the page.

Native only reads from Cyera, so the credentials need read access to datastores and classifications and nothing more.

Step 2: Know what Native reads from Cyera

Native uses three kinds of Cyera data to decide where each control belongs. It reads from Cyera and never writes back to it.

Cyera dataWhat Native uses it forExample
datastoresDatastore UID, cloud provider, cloud account ID, and region, so Native can match each Cyera datastore to the right resource in your environmentpayments-exports-prod · AWS · 123456789012 · us-east-1
classificationsThe data classes Cyera found in each datastore, such as PII, financial, credentials, and health, which Native tags onto the matched resourcePII, Financial, Credentials, Health
severityHow sensitive Cyera rates the datastore, which decides the control set Native activates for itCritical

If a Cyera datastore doesn’t match a resource Native manages, Native skips it and keeps synchronizing everything else. The integration doesn’t fail, it just covers less.

Step 3: Connect Cyera in Native

Once you have the Cyera credentials:

  1. Open Integration Center → Cyera in Native.
  2. Enter your Cyera API URL.
  3. Enter the Client ID.
  4. Enter the Client Secret.
  5. Click Connect.
  6. Confirm the connection is Healthy.
  7. Confirm the last successful sync and the number of datastores matched.

Step 4: Choose what classified data requires

In Native, open the data policy that Cyera classifications drive and choose which classifications and severities activate it. Review the impact Native evaluates for each matched datastore, then enforce. From then on, new and changed classifications pick up the same control set on the next sync.

Need the complete customer guide? Open the full Cyera integration guide in Native Docs (Native login required)

Technical details

Yes. Native reads datastore and classification data from Cyera and doesn’t write anything back. Enforcement happens in your cloud accounts, through each provider’s own controls.

Native pulls from Cyera on a schedule. New and changed classifications show up in enforcement on the next sync.

Datastore identity (datastore UID, cloud provider, cloud account ID, and region), the classifications Cyera assigned, and their severity. Native matches Cyera datastores to the cloud accounts and resources it already manages, so anything that doesn’t match contributes nothing.

Native activates the control set you defined for that data zone and evaluates the impact on the resources that depend on the datastore before anything is enforced. Your team sees what would change, and what it would affect, first.

AWS, Azure, Google Cloud, and OCI. The integration covers the object storage, managed databases, and analytics services that Cyera classifies and Native manages.

When Cyera classifies the new copy, or updates an existing classification, Native re-ingests it and applies or adjusts the controls on the next sync. The boundary moves with the data.

The complete Native customer guide is available in Native Docs, which requires a Native login.

Keep reading

Set up the integrationRequest a demo

See a Cyera classification become an enforced boundary in your own cloud.

Set up the Cyera integrationRequest a demo