Guardian Trust Centre
A security vendor that will not describe its own controls is asking for faith, not trust. This page documents the architecture, engineering practice, disclosure policy, data handling and availability commitments behind the Sentinel platform — in enough detail that your assessors can challenge it.
Operating principles
These are not aspirations. Each maps to a control that is tested by an external auditor at least annually and is evidenced in the SOC 2 Type II report available under NDA from the compliance centre.
Customer telemetry is processed to deliver the service you bought and for nothing else. We do not sell it, we do not use identifiable customer data to train models sold to anyone else, and contractual restrictions on secondary use survive termination.
There are no permanent production credentials, including for the engineering leadership team. Access is requested against a ticket, approved by a second person, time-boxed, fully recorded, and expires automatically. Break-glass paths page the security team.
Every internal service authenticates with short-lived workload identity and mutual TLS. There is no trusted network segment, no VPN that confers privilege, and no service that trusts a caller because of where the packet came from.
Critical vulnerabilities in our own code are remediated in production within 72 hours of a confirmed reproduction. Security-relevant fixes are documented in the public release notes rather than shipped silently.
If a confirmed security incident affects your tenant, you hear from us within 24 hours of confirmation — before we have every answer, with what we know, what we do not, and what we are doing about it. Updates continue until closure.
Every administrative action, configuration change, data export and support access event writes to a tamper-evident audit log that you can read, stream to your own SIEM and retain independently of us.
Platform architecture
Sentinel is a multi-tenant service, and multi-tenancy is only acceptable when isolation is enforced by cryptography rather than by a WHERE clause. The layers below are independent: a failure in any one of them does not grant access to customer data.
Secure development lifecycle
Guardian ships to production between forty and sixty times a day. That cadence is only safe if every control is automated and mandatory. Each gate below either passes or stops the build — there is no override that an individual engineer can apply alone.
| Activity | Performed by | Cadence |
|---|---|---|
| Application penetration test | Independent third party | Quarterly |
| Infrastructure penetration test | Independent third party | Twice yearly |
| Endpoint agent code audit | Specialist firm | Annual |
| Cryptographic design review | Independent cryptographers | Annual |
| Internal red team operation | Guardian Labs offensive team | Continuous |
| Tenant isolation assertion | Automated, in production | Every 5 minutes |
| Disaster recovery exercise | Platform engineering | Twice yearly |
| Tabletop incident exercise | Executive + security | Twice yearly |
Penetration test summary letters are available to customers and prospects under NDA. Full reports are shared with Enterprise customers on request.
Coordinated disclosure
If you have found a weakness in a Guardian product or service, we want to hear about it and we will not come after you for telling us. The policy below is our public commitment to researchers; the safe harbour clause is binding on Guardian.
In scope: the Sentinel console and API, all *.guardian.com web properties,
the endpoint and cloud sensors for every supported operating system, the mobile
applications, the partner portal, and the public connector SDK. Out of scope: findings
that require a rooted or physically compromised device, social engineering of Guardian
staff or customers, denial of service, volumetric or brute-force testing, reports
generated solely by automated scanners without demonstrated impact, and vulnerabilities
in third-party services we do not control.
| Stage | Commitment | 2025 median |
|---|---|---|
| Acknowledgement | Within 8 business hours | 2 hours 10 minutes |
| Triage and severity assignment | Within 24 hours | 11 hours |
| Reproduction confirmed or rejected | Within 5 business days | 2 days |
| Critical fix in production | Within 72 hours of confirmation | 31 hours |
| High fix in production | Within 14 days | 6 days |
| Bounty decision and payment | Within 10 business days of fix | 4 days |
| Public credit (if you want it) | On the next advisory cycle | — |
Data handling
Sentinel is a telemetry-driven product, so we are explicit about the categories of data it processes. Retention, residency and deletion are configurable per tenant, and the defaults below apply unless you change them.
| Category | Examples | Purpose | Default retention | Customer control |
|---|---|---|---|---|
| Security telemetry | Process execution, network flow metadata, authentication events, cloud audit logs | Detection, investigation, threat hunting | 90 days hot, 365 days cold | 30–2,555 days, per data type |
| Detection and case data | Alerts, incident timelines, analyst notes, response actions | Investigation and audit | Life of contract + 90 days | Exportable at any time |
| Asset and identity inventory | Hostnames, operating system versions, user principal names, group membership | Scoping, risk prioritisation, containment | Life of contract | Field-level masking available |
| Sample artefacts | Suspicious binaries and scripts submitted for analysis | Malware analysis and detection engineering | 180 days | Opt out of upload entirely |
| Content inspected by DLP | Document fragments matching a classification policy | Data loss prevention verdicts | Match metadata only, 90 days | Content never leaves your tenant |
| Administrative data | Console user accounts, roles, API keys, audit trail | Access control and accountability | Life of contract + 7 years for audit log | Streamable to your SIEM |
| Service telemetry | Sensor health, ingest volume, feature usage counters | Reliability, capacity planning, support | 13 months, aggregated | Pseudonymised by default |
Scroll the table sideways to see retention and control columns.
Choose your primary processing region at tenant creation: United States, Canada, European Union (Frankfurt), United Kingdom, Australia, Japan, Singapore, India or the Gulf region. Telemetry, indices and backups stay in region. Cross-region access by our support engineers requires your explicit, per-case approval.
See the residency mapDetection models are trained on Guardian Labs telemetry, licensed corpora, synthetic adversary emulation and customer data only where a customer has opted in under a specific written agreement. Opting out has no effect on detection quality in your tenant; per-tenant behavioural baselining is always local to you.
On termination your tenant becomes read-only for 30 days so you can export, then all production data is deleted within 30 further days and purged from backups within 90 days as the backup cycle rolls. A signed certificate of destruction is issued on request at no charge.
Supply chain transparency
The organisations below may process customer personal data on Guardian's behalf. Each is bound by a written agreement containing the standard contractual clauses where relevant, is assessed before engagement and re-assessed annually. Customers on any plan can subscribe to change notifications and receive 30 days' notice before a new subprocessor begins processing.
| Subprocessor | Service provided | Data categories | Processing location | Since |
|---|---|---|---|---|
| Amazon Web Services | Primary cloud infrastructure and object storage | All customer telemetry and account data | Customer-selected region | 2016 |
| Microsoft Azure | Secondary infrastructure for EU and UK regions | All customer telemetry and account data | EU (Frankfurt), UK (London) | 2019 |
| Google Cloud Platform | Infrastructure for APAC regions and analytics workloads | Customer telemetry | Singapore, Tokyo, Sydney | 2021 |
| Cloudflare, Inc. | Edge network, DDoS mitigation, WAF | Connection metadata only | Global edge, EU/US termination | 2017 |
| Twilio SendGrid | Transactional email delivery | Console user name and email address | United States, EU | 2018 |
| Zendesk, Inc. | Customer support ticketing | Support contact details, ticket content | United States, EU | 2017 |
| Atlassian Corporation | Engineering issue tracking for escalated defects | Pseudonymised diagnostic data | United States, EU | 2016 |
| Okta, Inc. | Guardian workforce identity and access management | Guardian personnel data only | United States, EU | 2018 |
| Datadog, Inc. | Platform observability and service telemetry | Service metrics, pseudonymised trace data | United States, EU | 2020 |
| Stripe, Inc. | Payment processing for self-service subscriptions | Billing contact and payment token | United States, EU | 2019 |
Scroll the table sideways to see all columns.
Reliability
Guardian commits to 99.99% monthly availability for the Sentinel control plane and 99.9% for the analytics and reporting plane. Sensor-side prevention continues to operate and enforce policy even if the control plane is unreachable — protection never depends on a live connection to us.
Resilience targets
Service credits
Missing the commitment is our failure, not a support ticket for you to raise. Credits are calculated automatically from our own measurement and applied to the next invoice without a claim.
| Monthly availability | Credit |
|---|---|
| 99.90% – 99.99% | 10% |
| 99.00% – 99.89% | 25% |
| 95.00% – 98.99% | 50% |
| Below 95.00% | 100% |
Corporate security
Most vendor compromises begin with a laptop, a contractor account or a forgotten SaaS integration rather than a novel exploit. Here is how we handle the boring parts.
Every employee and contractor authenticates through a single identity provider with phishing-resistant hardware security keys. Passwords alone cannot reach any Guardian system, and SMS and push-based factors are disabled outright.
Access is granted by role through automated joiner-mover-leaver workflows tied to the HR system. Entitlements are recertified quarterly by the owning manager; anything not affirmatively renewed is revoked. Departing staff lose all access within 15 minutes of the termination event being recorded, and the process is tested monthly.
All corporate devices run the Guardian sensor in enforcement mode with full-disk encryption, secure boot and a hardened baseline applied by device management. Device posture is a condition of access: a machine that falls out of compliance loses access to production and to sensitive SaaS applications until it is remediated.
We run our own product on ourselves in the same configuration we recommend to customers, and our internal detections are authored by the same team that writes yours. Escalations from our corporate SOC feed directly back into product detection engineering.
Background screening is performed on all employees and contractors before their start date, to the extent permitted by local law, and is repeated for roles with production access. Everyone signs confidentiality obligations that survive employment.
Security training is mandatory at onboarding and annually thereafter, with role-specific modules for engineers, support and anyone handling customer data. Phishing simulations run continuously; results drive coaching rather than punishment, because punishing reports is how you stop hearing about real ones.
Every vendor with access to customer data, production systems or Guardian source code goes through a security assessment before contract signature, is tiered by inherent risk, and is reassessed annually or on material change. Contracts require breach notification to Guardian within 24 hours.
SaaS applications connected to the Guardian tenant are inventoried continuously; OAuth grants are reviewed monthly and unused integrations are revoked automatically after 60 days of inactivity.
Guardian operates no data centres of its own. Production runs entirely on the cloud providers listed in the subprocessor table, each independently certified to ISO 27001 and SOC 2 with their own physical security programmes, which we review annually.
Guardian offices, including the five security operations centres, use badge access with individually issued credentials, visitor escort requirements, and separately access-controlled SOC floors with no removable media permitted.
The business continuity and disaster recovery plan is owned by the VP of Platform Engineering, reviewed twice a year and exercised at least as often. Exercises include unannounced regional failovers in production during business hours, because a recovery plan tested only at 3 a.m. on a Sunday tests nothing useful.
The 24/7 SOC follows the sun across five sites, so the loss of any single site degrades capacity rather than coverage. See Managed detection & response for the operating model.
If something goes wrong
We would rather tell you something uncomfortable early than something polished late. The timeline on the right is what a Guardian customer can expect if we confirm a security incident affecting their tenant, and it is written into the Data Processing Addendum rather than left to goodwill.
An incident commander is appointed within 15 minutes of declaration, independent of the team that owns the affected service. Containment begins immediately and does not wait for root cause.
We determine which tenants are in scope using immutable audit logs. If we cannot positively exclude a tenant, we treat it as in scope and tell that customer.
Affected customers are contacted through their designated security contact with what is known, what is not yet known, the containment steps taken and the actions we recommend on their side. Notification is never delayed for legal polish.
Written updates continue on a fixed cadence until the incident is closed, whether or not there is news. Silence is a symptom, so we do not do silence.
A written postmortem covering the timeline, contributing factors, customer impact and committed corrective actions with owners and dates. Published publicly for Severity 1 and 2 platform incidents.
Request the SOC 2 Type II report, ISO certificates, penetration test summaries and a completed CAIQ under NDA — or book a session with our security team to walk your risk function through the architecture line by line.