Skip to main content

Data Privacy

Guardian Pro is built with data privacy as a foundational design principle, not an afterthought. Every aspect of the platform -- from how data is collected, to how it is stored and processed -- is designed to protect the confidentiality and integrity of your information.

This page explains Guardian Pro's data handling practices, encryption standards, tenant isolation model, and your rights over your data.

What Data Does Guardian Pro Collect?​

Guardian Pro collects resource configuration metadata from your AWS accounts. This includes:

Data TypeExamplesWhat Is NOT Collected
Resource configurationsEncryption status, public access settings, logging configurationFile contents, database records, application data
Resource metadataResource IDs, ARNs, names, tags, regionsSecrets, passwords, API keys
Cost dataAggregated spending by service and regionIndividual transaction details
IAM metadataUser and role names, policy names, access key agesCredential values, secret keys
Network configurationSecurity group rules, VPC layouts, subnet CIDRsNetwork traffic, packet data
Key Principle

Guardian Pro reads how your infrastructure is configured, not what your infrastructure contains. Configuration metadata tells Guardian Pro whether your storage is encrypted, not what is stored in it.

Encryption​

At Rest​

All data stored by Guardian Pro is encrypted at rest using industry-standard encryption. Your resource configurations, findings, cost data, compliance records, and all other stored information is encrypted using AES-256 encryption with keys managed through a dedicated key management service.

In Transit​

All data transmitted between your AWS accounts and Guardian Pro, and between your browser and the Guardian Pro console, is encrypted in transit using TLS 1.2 or higher. This applies to:

  • API calls from the Guardian Pro console to the backend
  • Cross-account role assumption and AWS API calls
  • Real-time communication channels for live updates
  • Webhook notifications to external systems
note

Guardian Pro enforces HTTPS for all connections. HTTP requests are automatically redirected to HTTPS.

Tenant Isolation​

Guardian Pro is a multi-tenant service. Customers share the same underlying AWS infrastructure, and each organization's data is logically isolated.

How Isolation Works​

  • Every record is keyed to your organization -- Every record is stored under a key that starts with your organization's ID.
  • Credentials limited to your organization -- When Guardian Pro reads or writes your data, it uses short-lived AWS credentials limited to your organization. AWS Identity and Access Management (IAM) itself rejects any request for records or files outside your organization's keys (DynamoDB fine-grained access control with leading-key conditions, and S3 prefixes per organization).
  • Files under your own prefix -- Files are stored under your organization's own prefix with the same restriction.
  • Named exceptions -- A small set of platform jobs (for example scheduling and data deletion) and Guardian Pro's internal operations console work across organizations. They are limited to named functions, use separate credentials and are audited.

Verification​

Guardian Pro's tenant isolation is checked through:

  • Automated checks on every build that every stored key starts with the organization ID and that every function reading customer data runs on credentials limited to one organization (or is one of the named exceptions)
  • Regular security reviews of the data access layer

Data Residency​

Guardian Pro processes and stores data in the AWS region where the platform is deployed. Your resource metadata is collected from all AWS regions where your workloads run, but it is stored centrally in the Guardian Pro deployment region.

Data Collected from Your Accounts​

When Guardian Pro scans your AWS accounts, it reads resource configurations via AWS APIs. This data transits directly from your AWS account to the Guardian Pro service within the AWS network.

Data Retention​

Data TypeRetention Period
Active findingsRetained while the finding is active, plus historical records
Resolved findingsRetained for historical trend analysis and compliance auditing
Cost dataUp to 12 months of historical cost data
Scan resultsFull history retained for trend analysis
Compliance recordsFull history retained for audit reporting
AI Assistant conversationsRetained for the duration of your subscription
Audit logs365 days from each event, then deleted automatically

Data Deletion​

When you remove an account from Guardian Pro, all data associated with that account is permanently deleted.

When your subscription ends (cancelled, revoked or expired), your data is kept for 90 days so you can resubscribe without losing anything. After that it is permanently deleted from Guardian Pro, including user logins and stored files.

  • Backups -- Deleted data can remain in encrypted backups for up to 35 days before the backups expire.
  • Audit logs -- Audit logs are kept until their own 365-day expiry, even after the rest of your data is deleted. A legal hold can delay deletion until it is lifted.
  • What remains -- After deletion, Guardian Pro keeps only a minimal record of your organization that contains no personal data.

Deletion on Request​

You can ask for your organization's data to be deleted at any time, without waiting for the 90 days to pass. Your data is deleted within 7 days of a confirmed request.

  • While your subscription is active -- Open a support ticket with the category Data Deletion Request.
  • After your subscription has ended, or if you can no longer sign in -- Use the contact page on our website, from the email address associated with your account.

The same backup, audit-log and minimal-record terms apply.

AI and Your Data​

Guardian Pro uses AI capabilities to provide intelligent insights, power the AI Assistant, and generate infrastructure recommendations. Here is how your data is handled in AI interactions:

  • Your data is never used to train AI models -- Conversations with the AI Assistant and infrastructure analysis are processed but never used as training data.
  • Context is session-scoped -- The AI Assistant receives relevant context about your current environment to answer questions accurately, but this context is not persisted beyond the conversation.
  • No data sharing -- Your infrastructure data is never shared with third parties, including AI model providers.

Compliance Certifications​

Guardian Pro's infrastructure and data handling practices are aligned with industry security standards. The platform is deployed on infrastructure that maintains certifications including:

  • SOC 2 Type II
  • ISO 27001
  • GDPR compliance

For specific compliance questions or to request Guardian Pro's security documentation, contact support.

Your Rights​

As a Guardian Pro customer, you have the right to:

  • Access your data -- Export your findings, cost data, and compliance records at any time through the platform's export features.
  • Delete your data -- Request deletion of specific account data or your entire organization's data. See Deletion on Request.
  • Understand data processing -- This page, along with our privacy policy, provides transparency into how your data is handled.
  • Control data collection -- You control which AWS accounts are connected and can revoke access at any time by removing the IAM role.

Security Incident Response​

In the unlikely event of a security incident affecting your data, Guardian Pro will:

  1. Notify affected organizations within 72 hours of discovery.
  2. Provide a detailed incident report including scope, impact, and remediation steps.
  3. Offer direct support to help you assess any impact to your AWS environment.

To report a security concern, open a support ticket, or use the contact page on our website if you don't have a Guardian Pro account.

Next Steps​