A GRC tool that holds itself to GRC standards.
What a security team needs to know.
Each customer's data is logically separated and never reachable from another tenant, the segregation SOC 2, ISO 27001 and CAIQ/SIG ask about.
Append-only, the application can't alter or erase history. Every consequential action is recorded and examiner-queryable.
No standing cross-tenant access. Staff use break-glass: reason-required, 30-minute time-box, logged into the tenant's own trail.
Secrets sealed with AES-256-GCM; passwords scrypt-hashed; session tokens SHA-256-hashed at rest.
Private buckets only, no public objects, downloads via authed routes or short-lived (5-minute) signed URLs.
One identity, one tenant. SSO via OIDC (PKCE + nonce) and SAML, JIT into a single tenant.
Your data is never reachable from another customer's.
The first thing a security questionnaire checks is logical separation, no co-mingling, no path from one tenant to another. CardinalGRC is built so each customer's data is segregated by default and unreachable from any other tenant, and we test that it stays that way on every data path.
Separation is enforced beneath the application, not left to a query someone has to remember, so a bug in one tenant's code can't surface another tenant's data.
- CAIQ / SIG
- The multi-tenancy, logical-separation and data-segregation items on the standard questionnaires.
- SOC 2 / ISO 27001
- Logical separation of customer data in a shared environment, described in the report and tested by the auditor.
- Vendor / TPRM reviews
- The data co-mingling question: your data must not be reachable from another tenant.
- Outsourcing guidance
- Segregation in shared infrastructure, a routine ask under FFIEC-style and CBN risk-based expectations.
Three kinds of principal, and what each can see.
Every actor on the platform is one of three, each with a different, deliberately-narrow scope.
Your people
Every request is scoped to your organisation and nothing else. Roles follow the Three Lines of Defence; maker/checker is enforced per item.
Our staff
No standing access to your data. Support is explicit, reason-required, time-boxed to 30 minutes, and logged into your own audit trail.
External guests
Scoped to a single engagement, seeing a provenance projection, never your live data, and never anything outside that engagement.
Append-only, examiner-queryable.
Every consequential action is recorded with actor, action, resource and detail: sign-ins, each maker/checker approval, every break-glass read. The application has no permission to alter or erase it. Search spans the whole log: full-text, by domain, by source, per-resource timeline, per-actor activity.
Surfacing staff access is the feature.
Our staff have no standing access to your data. The only path demands a reason, expires in 30 minutes, and writes both a grant record and an audit entry into your own log. You see exactly when, why, and what was touched.
The controls we sell, held by the product.
- Every data path carries a cross-tenant separation test, one tenant cannot read another's data.
- Segregation-of-duties rejection tests prove an author can't approve their own item.
- The suite runs against a real database, deliberately without administrative privileges (which would pass separation tests for the wrong reason).
A short list, on purpose.
We run on a deliberately small set of providers: cloud hosting, object storage and email delivery, each under contract with appropriate safeguards. The current list, with what each one processes and why, is available on request, and we notify customers before it changes.
If you find something, we want to know.
Report suspected vulnerabilities to security@cardinalgrc.com. Good-faith research is welcome: don't access data that isn't yours or disrupt the service, and we won't pursue legal action. We acknowledge every report and confirm when the issue is resolved.
Built to the standards we help you meet.
CardinalGRC is engineered to ISO 27001 and SOC 2 control expectations from the first line of code. Formal third-party certification of the platform itself is on our roadmap, and we'll report it here when it lands, not before. For a security questionnaire or a deeper review, reach us at security@cardinalgrc.com.
Compliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.