Certifications & compliance
Guardian holds the attestations that regulated buyers actually ask for, and we publish the audit calendar, the framework mapping and the residency model behind them. Everything on this page is available as evidence you can hand to an assessor — most of it the same day you ask.
Current attestations
Scope statements matter more than logos. Each entry below names the auditor, the report period and exactly which parts of the Guardian estate are in scope — because a certification covering only the corporate website is worth nothing to a security buyer.
All five Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy. Covers the Sentinel platform, sensors, the analyst console, the public API and the supporting production infrastructure in every commercial region.
Information security management system covering the design, development, delivery and support of the Sentinel platform and Guardian managed services, across all engineering and SOC locations. Statement of Applicability available on request.
Cloud-specific security controls (27017) and protection of personally identifiable information in public clouds (27018), audited alongside the 27001 management system by the same certification body under a combined scope.
Authorised at the High impact level for the Guardian Government Cloud, sponsored by a cabinet-level agency, with continuous monitoring deliverables submitted monthly. DoD Impact Level 5 provisional authorisation held for the same environment.
Assessed as a Level 1 service provider for the components of Sentinel that may process cardholder data telemetry on behalf of customers. Attestation of Compliance and responsibility matrix are issued to customers for their own assessments.
Guardian executes a Business Associate Agreement with covered entities and business associates, and holds HITRUST CSF r2 certification for the healthcare-scoped environment. Safeguards are mapped to the Security Rule at control level.
Guardian acts as processor for customer telemetry under a Data Processing Addendum incorporating the 2021 Standard Contractual Clauses and the UK Addendum. Certified under the EU–US and UK Data Privacy Frameworks; EU representative appointed in Ireland.
Third-party attested against the Cloud Controls Matrix v4, with a completed Consensus Assessments Initiative Questionnaire published to the STAR registry. Most customer security questionnaires can be answered directly from it.
IRAP assessed to PROTECTED for the Australian region, BSI C5:2020 attestation for Germany, TISAX AL3 for automotive customers, Cyber Essentials Plus in the UK, and ENS Medio for Spanish public sector.
Audit cadence
Compliance evidence is generated continuously by the same pipelines that run the platform, so audits are a sampling exercise rather than a discovery exercise. This is the standing calendar; dates shift by a few weeks but the sequence does not.
Framework coverage
Two questions matter to a compliance team: is the vendor itself compliant, and does the product help me become compliant. The table separates the two, because a vendor's own certificate does nothing for your audit if the product produces no evidence.
| Framework | Guardian status | Product support for your programme | Evidence you can export |
|---|---|---|---|
| SOC 2 (TSC 2017) | Type II | Control monitoring for logical access, change management and system operations | Continuous control status, exception register, evidence packets |
| ISO/IEC 27001:2022 | Certified | Annex A technical control coverage with automated gap reporting | SoA mapping export, control effectiveness history |
| NIST CSF 2.0 | Aligned | Function-level scoring across Govern, Identify, Protect, Detect, Respond, Recover | Maturity scorecard, trend over 24 months |
| NIST SP 800-53 Rev 5 | FedRAMP High | Control inheritance statements and a customer responsibility matrix | Inheritance letter, POA&M extract |
| PCI DSS v4.0 | Level 1 SP | File integrity monitoring, log retention, segmentation validation evidence | AoC, responsibility matrix, quarterly evidence pack |
| HIPAA Security Rule | BAA offered | PHI discovery, access monitoring and breach investigation timelines | Access reports, disclosure accounting extracts |
| GDPR / UK GDPR | Processor, DPF certified | Data discovery, residency enforcement, subject request support | DPA, TIA, records of processing extract |
| DORA (EU financial entities) | Contractually aligned | ICT incident classification, register of information fields, resilience testing | Incident register export, subcontracting chain |
| NIS2 (EU essential entities) | Contractually aligned | 24-hour early-warning workflow and supply chain risk reporting | Notification timeline export |
| CMMC 2.0 Level 2 | Supports assessment | CUI marking, boundary monitoring and audit record protection | Practice-level evidence mapping |
| APRA CPS 234 / CPS 230 | Aligned | Information asset classification and testing evidence for regulated entities | Control testing register |
| CIS Critical Controls v8.1 | Aligned | Implementation group scoring across all 18 controls | IG1–IG3 scorecard, per-safeguard status |
Scroll the table sideways to see evidence columns.
Need help closing the gap rather than measuring it? Guardian's compliance advisory practice runs readiness assessments and remediation programmes against every framework listed here.
Data residency
Residency is selected when a tenant is created and enforced by the platform rather than by policy. Ingestion, indexing, analytics, backups and search results all remain in the chosen region. Cross-region access by Guardian personnel requires your per-case approval and is recorded in your audit log.
| Region | Identifier | In-region backup | Regional schemes in scope |
|---|---|---|---|
| United States (East) | us-east-1 | Yes | SOC 2, PCI DSS, HIPAA, CSA STAR |
| United States (West) | us-west-2 | Yes | SOC 2, PCI DSS, HIPAA, CSA STAR |
| US Government | us-gov-high | Yes | FedRAMP High, DoD IL5, CJIS, ITAR |
| Canada | ca-central-1 | Yes | SOC 2, PIPEDA, Protected B |
| Brazil | sa-east-1 | Yes | SOC 2, LGPD |
| United Kingdom | uk-south-1 | Yes | UK GDPR, Cyber Essentials Plus, G-Cloud |
| European Union | eu-central-1 | Yes | GDPR, BSI C5, TISAX, ENS, DORA-aligned |
| Gulf region | me-central-1 | Yes | SOC 2, UAE IA, Saudi NCA ECC |
| India | ap-south-1 | Yes | SOC 2, DPDP Act, CERT-In directions |
| Singapore | ap-southeast-1 | Yes | SOC 2, MAS TRM-aligned, PDPA |
| Japan | ap-northeast-1 | Yes | SOC 2, ISMAP-aligned, APPI |
| Australia | ap-southeast-2 | Yes | IRAP PROTECTED, APRA CPS 234-aligned |
Scroll the table sideways to see all columns.
Document library
Documents marked open download immediately. Documents marked NDA are released through the trust portal once a mutual non-disclosure agreement is in place — usually the same business day, and existing customers already covered by their master agreement skip the step entirely.
Full report including the auditor's opinion, system description, control objectives and the complete results of testing for the current observation period.
Request accessCurrent certificates with scope statements and certification body registration numbers, plus the Statement of Applicability summary.
DownloadCompleted CAIQ against Cloud Controls Matrix v4.0.7. Answers most vendor security questionnaires without a bespoke response cycle.
DownloadExecutive summaries for the four most recent independent tests, with finding counts by severity and remediation status. Full technical reports for Enterprise customers.
Request accessThe standing DPA including the 2021 Standard Contractual Clauses, UK Addendum, Swiss annex and the current subprocessor schedule.
Read the privacy policyGuardian's assessment of the legal regimes affecting international transfers, supplementary measures applied, and the government access request record.
DownloadDetailed description of tenant isolation, key management, network design and the control plane for architects who need to challenge the model.
Trust & securitySystem Security Plan, SAR, POA&M and continuous monitoring artefacts, released to agencies through the FedRAMP secure repository.
Government & defenceControl-by-control statement of what Guardian operates, what you operate, and what is shared — the document your auditor will actually ask for.
DownloadSecurity questionnaires, bespoke control mappings, insurance certificates, business continuity plan summaries and modern-slavery statements are all available. Send the request to [email protected] with your organisation name and the framework you are reporting against.
Sector and regional obligations
Guardian contracts include the mandatory DORA provisions for ICT third-party service providers: exhaustive service descriptions, data processing locations, notice periods, exit strategies, subcontracting conditions and the right of access, inspection and audit for both you and your competent authority.
Operationally, Sentinel classifies ICT-related incidents against the DORA criteria and produces the initial, intermediate and final notification content within the regulatory windows. Register of information fields are exported in the supervisory template. See Financial services.
The platform tracks the 24-hour early warning, 72-hour notification and one-month final report obligations as a single incident workflow with countdown timers, so the deadline is visible to the responder rather than buried in a policy document.
Supply chain security requirements are supported through third-party risk monitoring and the exportable subprocessor chain described on Trust & security.
Guardian signs a Business Associate Agreement on every plan at no extra cost. Technical safeguards under §164.312 — access control, audit controls, integrity, authentication and transmission security — are implemented and evidenced in the SOC 2 report and HITRUST certification.
For breach determination, Sentinel reconstructs exactly which records were accessed, by which identity, from where, and whether the data was encrypted at the time, which is the difference between a reportable breach and a documented non-event.
Guardian is assessed annually as a Level 1 service provider and issues an Attestation of Compliance together with a responsibility matrix covering all twelve requirement areas. Requirements 10 (logging and monitoring), 11 (testing) and 12 (policy support) are where most customers inherit meaningful coverage.
The 2025 future-dated requirements — including targeted risk analyses and automated log review — are already implemented rather than deferred.
Guardian requires valid legal process for any government request for customer data, challenges overbroad or improperly served demands, and notifies the affected customer unless legally prohibited from doing so. Where a gag order applies, we challenge it and notify as soon as the prohibition lapses.
We publish a transparency report twice a year covering the number of requests received by category, the number complied with in whole or in part, and the number rejected. To date Guardian has never provided a government with bulk access to customer telemetry, and we have never received a request for a systemic backdoor.
Enterprise customers and their regulators have contractual audit rights. In practice most requirements are satisfied by the SOC 2 report, ISO certificates and the CAIQ, so our first offer is always documentation. Where documentation is genuinely insufficient, we accommodate a scoped assessment with 30 days' notice, once per year, at no charge.
Regulated customers subject to DORA, CPS 230 or equivalent regimes get audit and inspection rights extended to their supervisory authority as standard contract terms rather than as a negotiated concession.
From evidence to outcome
Sentinel evaluates your estate against the framework you select and reports control status continuously, so the quarter-end evidence hunt becomes an export rather than a project. Drift is flagged the day it happens, not the week before the audit.
Screenshots, configuration snapshots, access reviews and log samples are collected automatically with cryptographic timestamps, packaged per control and handed to your auditor in the format they asked for.
The completed CAIQ, SIG Lite responses and framework mappings answer the majority of inbound customer security questionnaires directly, which matters most if you are yourself a supplier being assessed.
Every incident carries an immutable timeline: what was detected, when, who acted, what was contained and what was notified. That record is what turns a regulator conversation from an argument into a review.
Request the full evidence pack, or book a working session with Guardian's compliance team and your assessors to map our controls onto your framework line by line.