Security

Platform security and assurance.

Review the implemented workspace controls, assessment handling and available assurance information. Controls depend on deployment configuration and do not replace an independent assessment or agreed service commitments.

Report a vulnerability

Workspace access and evidence

Hospital-scoped membership, runtime/policy MFA enforcement and session revocation
Optional Microsoft Entra sign-in with explicit member linking
Patient records, histories, document bytes and portal content use application encryption at rest; account and audit metadata are handled separately
Revision history, audit-integrity tooling and encrypted backup verification
Patient-data ingestion is disabled by default; real-data mode requires an operator-set BAA assertion, not a user-supplied upload flag
Clinical validation and governed identity merge/unmerge are not established; security AI tools do not access patient-record datasets
Deployment configuration and operational checks are required; these controls do not establish certification or high availability

Manual assessment handling

One agreed enforcement boundary, reviewed from customer-supplied exports
No retention of source artefacts — a firewall config and flow records are deleted within 30 days of the report, with written confirmation
Agree the scope, handling terms and transfer method before sending assessment files
The public contact form is for general enquiries, not patient data, credentials or assessment files

Public website protections

Contact requests are checked for required fields and size limits before delivery
A contact submission succeeds only when a configured delivery provider accepts it
Application delivery logs record delivery outcomes without message contents or contact details
Website headers are configured to block framing and content-type sniffing

Assurance availability

If you are in procurement or third-party risk at a health system, this is the section you came for. We would rather you find it here than discover it in week six of a security review.

SOC 2 Type II — no report published.
ISO 27001 / 27017 / 27018 — not held.
ISO/IEC 42001 — not held.
BAA — not currently offered by Guardra. Do not send PHI through public contact forms. An operator configuration assertion does not create or verify an agreement.
FedRAMP / StateRAMP — not in process.
External penetration test — no report or schedule published.
Product assurance — no published SDK, signed product releases or SBOM.
Bug bounty programme — not yet running. Report to security@guardra.ai in the meantime.

Published assurance evidence will identify its scope, issuer and date. Confirm the documents and contractual commitments required for your deployment.

Reporting a vulnerability

Email security@guardra.ai. Safe harbour for good-faith research, acknowledgement within one business day, and a 90-day default disclosure window. The full policy is on the advisories page.