Trust
Read-only by design.
What we do with your data, stated plainly. This page describes only what is true today.
Our approach
CoreGuardian connects to your tools through read-only APIs, with the least privilege each connector needs. There are no agents to install and nothing that can change your environment.
Data protection
- Hosted in the United States.
- Encrypted at rest and in transit.
- Connector credentials encrypted and never written to logs.
- No path from the public internet to where your data is stored.
Tenant isolation
Each tenant’s data is isolated. Organizations with subsidiaries see down their own hierarchy, never across it.
Access
SAML single sign-on per tenant. TOTP multi-factor authentication is required for privileged roles.
Auditability
Audit logging aligned to NIST AU-3. Evidence is held in a tamper-evident locker, so an assessor can confirm nothing changed after collection.
Responsible disclosure
Report security issues to security@coreguardian.com. We acknowledge reports within two business days.
Scope: this site and the CoreGuardian platform. Please give us a reasonable chance to fix an issue before public disclosure. We will not pursue legal action against researchers who make a good-faith effort to follow this process and avoid privacy violations, service disruption, or data destruction.
Request our security package
Architecture, data-flow and hosting details, plus our security questionnaire and CAIQ, are available on request under NDA.