Trust Center
Security, data handling and assurance.
Guardra combines a hospital information workspace that can store identifiable patient records and documents with a separate security evidence platform and manual assessment tools. Patient-data ingestion is disabled by default; real-data mode requires operator authorization asserting a BAA. This setting does not establish compliance, an executed agreement or clinical readiness.
Procurement artefacts
- Published
Read the public disclosure policy.
- Published
Inputs, deliverables and limits of the manual assessment.
- Published
Assessment terms and data handling
Read the terms and agree any engagement-specific requirements before transferring files.
- Not published
Product architecture & data-flow description
No software-platform architecture document is published here.
- Not published
Data Processing Agreement (DPA)
Ask about availability and review requirements before an engagement.
- Not published
Master Services Agreement
Engagement terms must be agreed directly; no MSA template is published here.
- Not yet
Business Associate Agreement (BAA)
Not currently offered by Guardra. Patient-data ingestion is gated by server operator configuration; that assertion does not create or verify an agreement. Do not send PHI through the public contact form.
- Not published
SOC 2 report
Internal readiness work has started. No independent SOC 2 report is available; readiness work does not establish SOC 2 compliance.
- Not yet
ISO 27001 certificate
Not held.
- Not published
Penetration test summary
No external report or test schedule is published here.
- Not published
SBOM
No product software bill of materials is published here.
- Not published
Service Level Agreement
No hosted-workspace availability SLA is published here. Agree service commitments before relying on them.
Hosting and integrations
This overview describes hosting and supported integrations. Optional integrations are not necessarily enabled for your workspace. Confirm active providers, data flows, processing locations and agreements before sharing sensitive information. This is not a verified contractual subprocessor register.
- Amazon Web ServicesHosted workspace infrastructure in Ohio (us-east-2), including application storage and backup tooling. Availability and recovery commitments must be agreed separately.
- Microsoft EntraOptional hospital Microsoft sign-in. Administrators link Microsoft identities to existing Guardra members; Guardra permissions and MFA still apply.
- Amazon BedrockOptional security copilot and risk-agent generation. Enabled requests send selected security evidence to Bedrock in the configured US AWS regions; some agent profiles use Ohio, Northern Virginia or Oregon. Patient-record datasets are not exposed as agent tools.
- Amazon SES / ResendEmail delivery according to the configured provider, including account, support or contact messages. Confirm the active provider for your deployment.
- Google reCAPTCHAAbuse protection on authentication flows when configured.
- Upstash RedisContact abuse limits when configured; receives keyed email hashes and temporary counters, not enquiry contents.
- Configured webhook destinationAdditional contact delivery when enabled; request the destination before sharing sensitive context.
- PlausibleWebsite analytics when enabled.
- Google FontsThe website requests font styles and files from Google.
The optional evidence copilot provides read-only assistance and requires human review. Local browser assessment tools are separate from team saves and copilot requests. Use the contact form for general enquiries only; agree assessment and workspace data handling separately.
Procurement and security enquiries
Share your procurement requirements so Guardra can identify available evidence, outstanding requirements and any deployment-specific conditions before an engagement is agreed.
For questions about assessment scope, data handling or required agreements, start a conversation before sending any assessment files.
Discuss procurement requirements