Legal & trust
Our posture — observed, not asserted
Every GRC vendor publishes a polished trust badge. We publish what’s actually true about our own security — and we tag each claim by how it’s known, the same way the product tiers your evidence. If a thing is only asserted, we say so.
ObservedYou can verify this yourself, right now — no account, no trust in us required.
AttestedBacked by our architecture or an independent audit. You're trusting the design or the auditor, not a live reading — yet.
AssertedOur statement. Not independently verifiable — so we label it as such instead of dressing it up.
Cookieless analytics; no cookies or cross-site/ad trackers
ObservedOpen your devtools — no cookies set; analytics (Vercel) is cookieless and first-party (/_vercel/insights), no cross-site scripts.
Minimal collection — one email field, no accounts, no tracking
ObservedRead the page: one email input, no login, no third-party trackers.
Encrypted transport and security headers
ObservedInspect the TLS certificate and HTTP response headers.
A real vulnerability-disclosure policy
ObservedIt is live at /security and /.well-known/security.txt.
Your security data never enters our cloud
AttestedGuaranteed by federation — one install per company, on your infrastructure.
→ promotes to Observed when the live view ships
One fully isolated install per company
AttestedFederation is real isolation, not a shared-cloud partition.
→ promotes to Observed when the live view ships
SOC 2 Type II
AttestedIndependent third-party audit.
Roadmap — not yet, and we say so
ISO 27001 alignment
AttestedIndependent third-party audit.
Roadmap — not yet, and we say so
Profitable by design at a small number of customers
AssertedNo investor growth mandate to fund.
Built by an 18+ year practitioner, AI-multiplied
AssertedOne expert's judgment, not committee bloat.
Where your data lives
Live view coming soon
GRC Solo observes on your side and records only judgments. Your raw security data never crosses into our cloud — so we can't lose, leak, or be compelled to hand over what we never receive.
Why trust a solo-built platform
The posture above is the what. Here’s the why — every concern we hear, answered with a fact, then flipped into the advantage only a solo, federated vendor can claim.
“If you disappear, my multi-year compliance program dies.”
The factIt doesn’t. The platform runs on your infrastructure, not ours — your install, your data, and the control library you build are yours. If we vanished tomorrow, your program keeps running and your data stays put.
Why that’s an advantageYour compliance doesn’t depend on us staying alive. That’s more than a venture-backed vendor routing your data through their cloud can promise.
“Is a GRC tool holding my security data even safe?”
The factWe hold none of it. Your evidence and secrets never enter our cloud — the platform observes and reconciles on your side. We can’t lose, leak, or be subpoenaed for data we never receive.
Why that’s an advantageThe most secure GRC tool is the one that never sees your data. Our posture above is observed, not asserted — we live by it.
“Will you still be here in two years?”
The factThe business is built to be sustainable and profitable at a small number of high-value customers — not to burn cash chasing hyper-growth or the next funding round.
Why that’s an advantageWe don’t have to 10× or die. A profitable, focused business tends to outlast funded startups that must.
“Can one person really build enterprise-grade GRC?”
The factIt’s built by a practitioner with 18+ years running real GRC programs, with modern AI multiplying the output of a team. The architecture is engineered to hold at scale — and the product is the proof, not a pitch deck.
Why that’s an advantageEvery decision is one expert’s judgment instead of committee bloat. You get depth, not a feature checklist sold by people who’ve never run an audit.
“Who do I call when something breaks?”
The factThe person who built it. Support and triage are wired in, with defined response commitments for paid tiers.
Why that’s an advantageYou talk to the engineer who understands your problem — not an offshore tier-1 script reading from a runbook.
“Serious GRC always costs a fortune.”
The factThere’s no sales org, no investor margin, and no bloat to fund. That cost structure passes straight through to you.
Why that’s an advantageEnterprise-grade GRC without a dedicated department — or a department-sized budget. Serious capability, de-gatekept.
The whole platform is built on one idea: stop trusting what’s declared and start reconciling against what’s observed. This page holds us to the same bar.