Security

Our Commitment

Guard0 is the independent system of record for enterprise AI agents, so our customers trust us with visibility into some of their most sensitive systems. This page describes the controls we run today. Where a control is still being rolled out, we say so.

We are committed to:

• Protecting customer data with encryption and access controls
• Telling customers plainly about our security practices and about incidents that affect them
• Improving our controls through scanning, monitoring and independent audit
• Giving enterprise customers the security documentation they need to assess us

Infrastructure Security

Cloud Infrastructure

Guard0 runs on Amazon Web Services (AWS), which holds its own SOC 2 Type II report and ISO/IEC 27001 certification for the infrastructure we build on. Infrastructure is defined in Terraform and deployed through ArgoCD, so every change is reviewed and recorded.

Data Encryption

In Transit: Traffic between customer systems and Guard0 is encrypted with TLS.

At Rest: Customer data stored in AWS is encrypted with AES-256, using keys managed by AWS Key Management Service.

Network Security

• Private Networks: Production services run in private AWS VPC networks, with security groups limiting which services can reach each other
• Threat Detection: AWS GuardDuty monitors our primary AWS region for suspicious activity
• DDoS Protection: AWS Shield protects our public endpoints against common network-level attacks

Access Controls

• Two-Step Verification: Two-step verification is enforced on all staff accounts
• Role-Based Access: Staff get access to the systems their role needs, and access is removed when they leave
• No Stored Cloud Keys: Our deployment pipeline reaches AWS through GitHub OIDC instead of stored keys, and each production service runs under its own scoped AWS role. We are moving the remaining long-lived AWS users to the same model
• Audit Logging: AWS CloudTrail records administrative actions in our AWS accounts. These logs are kept for 365 days in storage that cannot be altered or deleted (S3 Object Lock)

Customer Sign-In

Customer sign-in to Guard0 is handled by Auth0, so Guard0 does not store customer passwords.

Application Security

Code Review

Changes to product code are reviewed by another engineer before they merge, and security is part of that review.

Code and Dependency Scanning

GitHub code scanning, secret scanning and Dependabot run on our product repositories. We are extending them to every repository we own and working through open alerts in order of severity. When a credential is found in code or in its history, we rotate it.

Monitoring

Production alerts from Prometheus and Alertmanager go to our engineering team in Slack.

Data Protection

Multi-Tenant Data Isolation

Guard0 is a multi-tenant platform. Each customer's data is kept separate from every other customer's:

• Each customer's data is logically isolated
• Database-level access controls prevent cross-tenant queries
• Application logic enforces tenant boundaries at every layer

Data Classification & Handling

We classify the data we hold (customer data, internal data, third-party data) and follow written procedures for how each class is handled, transmitted and stored.

Backups

Production databases are backed up automatically, and backups are encrypted to the same standard as the data they hold.

Data Retention & Deletion

Customer data is retained only as long as necessary to provide the Guard0 service, as detailed in our Privacy Policy. When a customer asks, or when a contract ends, we delete their data as the Privacy Policy sets out.

Compliance & Certifications

SOC 2 Type II

Guard0 is preparing for a SOC 2 Type II audit by an independent firm. Our controls are mapped to the AICPA Trust Services Criteria, and we will share the report with customers under NDA once it is issued.

GDPR Compliance

Guard0 complies with the General Data Protection Regulation (GDPR) requirements applicable to our role as a data processor for EU customers:

• Data Subject Rights: We support customer fulfillment of GDPR data subject access requests, deletion requests, and portability requests
• Processing Agreements: Data Processing Agreements (DPAs) are available for all EU customers
• Privacy by Design: Personal data processing is designed with privacy protection as a core requirement
• Breach Notification: We maintain procedures to notify affected customers and relevant authorities in compliance with GDPR timelines

CCPA Compliance

Guard0 complies with the California Consumer Privacy Act (CCPA) requirements:

• Consumer Rights: We support customer fulfillment of CCPA consumer rights requests
• Data Minimization: We collect and process only the personal data necessary to provide the Guard0 service
• Opt-Out Support: Customers can control how their data is used and disclosed

Data Processing Agreements

Data Processing Agreements are available for enterprise customers upon request and can be obtained by contacting security@guard0.ai or your account manager.

Incident Response

Incident Response Procedure

Guard0 has a written incident response procedure that sets out:

• Roles & Responsibilities: Who leads an incident and who is involved
• Detection & Response: How we identify, contain and recover from an incident
• Communication: How we escalate internally and notify affected customers
• Recording: Every incident is recorded with its timeline, severity and resolution

Customer Notification

In the event of a confirmed data breach affecting customer data, Guard0 will notify affected customers as quickly as possible, and no later than 72 hours after confirmation, consistent with GDPR. Notifications will include details of the data affected, steps customers should take, and Guard0's remediation efforts.

Post-Incident Review

After an incident, the procedure requires a review to:

• Find the root cause
• Identify changes that prevent it happening again
• Track those changes to completion

Employee Security

Background Checks

We carry out background checks on staff, consistent with local legal requirements.

Security Awareness Training

Security awareness training is part of onboarding for every member of staff. It covers:

• Phishing and social engineering awareness
• Data protection and privacy principles
• Secure password and credential practices
• Incident reporting procedures
• Customer data handling requirements

Confidentiality Agreements

All Guard0 employees sign confidentiality and non-disclosure agreements as a condition of employment, protecting customer data and proprietary information.

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you discover a potential vulnerability in Guard0:

1. Do not publicly disclose the vulnerability
2. Email security@guard0.ai with a detailed description, including steps to reproduce the vulnerability, potential impact or severity, and your contact information
3. Expect acknowledgment of your report within 48 hours
4. Allow reasonable time for Guard0 to develop and deploy a fix before public disclosure

We will make good-faith efforts to address valid reports promptly, and we are glad to credit researchers (with permission).

Enterprise Security

Security Documentation & Assessments

Enterprise customers can request:

• Security Questionnaire Responses: Completed responses to your organization's security assessment questionnaires
• Data Processing Agreements (DPA): Data processing agreements for GDPR and other regulatory requirements
• Architecture Documentation: Technical documentation of Guard0's security architecture and controls
• SOC 2 Report: Our SOC 2 Type II report, under NDA, once it is issued

Enterprise customers should contact security@guard0.ai or their account manager to request any of these materials.

Questions or Concerns?

If you have questions about Guard0's security practices or have identified a potential vulnerability, please contact:

security@guard0.ai

Enterprise customers with dedicated support can also reach out to their account manager.