Security

GRC Solo runs as one isolated install per company — never a shared-cloud partition. Federate it on your own infrastructure and your operational security data — evidence, secrets, control state — is observed in place and never routed through our cloud: there is nothing on our side to breach, leak, or subpoena, because we never receive it. Prefer a hosted install? It's still isolated to your company alone. On this marketing site, the only thing we store is the email you submit (held with our US subprocessor).

All traffic is served over TLS with HSTS (includeSubDomains; preload). Connections are upgraded to HTTPS; the site declares a strict transport and content policy. You can inspect the certificate and response headers yourself — consistent with our observe-don't-assert thesis.

This site runs a hardened baseline: a per-request nonce'd Content-Security-Policy (nounsafe-inline scripts), X-Frame-Options: DENY / framing locked,X-Content-Type-Options: nosniff, a restrictive Referrer-Policy andPermissions-Policy, and rate-limited public APIs. We practise data minimization — one email field, no accounts, and no cookies or cross-site/ad trackers.

We keep a disciplined, code-observed subprocessor list at /subprocessors — what actually processes data, not vendor boilerplate. Our site assistant is grounded on our published facts and runs on the Anthropic API, which does not train on API inputs. We don't sell or share your data.

In a federated install the platform runs on your infrastructure: you own the data plane and its isolation; we provide the software, its updates, and the reconciliation engine. Unlike the static shared-responsibility PDF nobody reads, the split is one the product itself observes and reconciles — the same discipline we apply to your controls, applied to the boundary between us.

Because a federated install is on your own infrastructure, your data is already yours — the install, your control library, and the decision ledger stay with you. Ending your subscription means license deactivation and export, not a scramble to extract data from our schema. The one email we hold on this site is deletable on request — see /privacy.

SOC 2 Type II and ISO 27001 alignment are on our roadmap, via independent third-party audit — and we say so plainly rather than imply a badge we don't hold yet. Our current commitments are this architecture and the disclosure policy below.

Email security@grcsolo.com with enough detail to reproduce the issue: what you found, where, and the steps to trigger it. Machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we'll treat your report as authorized. We'll acknowledge your report, keep you updated on our assessment and fix, and — with your permission — credit you once the issue is resolved.

In scope: this website and the infrastructure that serves it.

Please avoid: denial-of-service, spam, social engineering of our people, physical attacks, and any testing that accesses, modifies, or destroys data that isn't yours. Use only test/synthetic data and stop at the first sign you can demonstrate a vulnerability — you don't need to go further to prove it.

Consistent with the thesis, we publish our own security posture rather than assert it — provenance-tiered as observed, attested, or asserted at /trust. A fuller live trust surface, emitted by the product from observed state, is on the roadmap.