Security & Trust
Security at TerraSecure
How we design, operate and continuously test Guardian to protect your data — and what you can expect from us.
Published by TerraSecure
Our approach
Guardian exists to help teams find and fix security problems, so the platform itself is held to the same standard. TerraSecure applies layered technical and organizational safeguards across the service — and treats security as an ongoing program, not a one-time checklist.
This page summarizes our practices at a level useful to customers and evaluators. Detailed control documentation, architecture descriptions and security questionnaire responses are available on request to current and prospective customers.
What we commit to
Protected in transit and at rest
Customer data is encrypted while it moves across our service and while it is stored, using modern, industry-standard encryption.
Isolated by organization
Every workspace is logically separated at the data layer. One organization's assets, findings and reports are never visible to another's.
Least-privilege access
Access follows graded roles with the minimum permissions each function needs. Administrative actions are limited, reviewed and logged.
Complete, exportable audit trail
Security-relevant actions — sign-ins, configuration changes, scans, report exports — are recorded in a tamper-evident log your team can review.
Credentials stay secret
Integration and scanner credentials you provide are stored for use by the platform only and are never displayed back in full to any browser session.
We test ourselves first
Guardian's own application is subjected to the same code, dependency and web assessments the platform performs for customers, on every release.
Authorized testing, enforced
Guardian is built for authorized security testing. Scanning requires documented authorization for every target, our scanning engines operate in a controlled environment, and all assessment activity is recorded. Unauthorized use is a breach of our Terms & Conditions and is acted on.
People and process
- Multi-factor authentication is available for every account, and required for TerraSecure staff with privileged access.
- Change to the platform goes through review before release, with the ability to roll back quickly.
- Staff access to customer data is restricted, time-bound and logged; we do not browse customer workspaces without a support reason.
- We maintain an incident response process: if a security incident ever affects your data, we notify affected customers without undue delay.
Your data, your control
Your security data belongs to your organization. You can export reports at any time, and when your subscription ends we retain data only for the short window described in our Privacy Notice before deleting or anonymizing it. We do not sell personal data or use your security data to market to anyone.
Responsible disclosure
If you believe you have found a security issue in Guardian, we want to hear about it. Email support@terrasecure.co with enough detail for us to reproduce the issue, and we will acknowledge your report promptly, keep you informed of progress and credit researchers who help us, if you wish.
Control alignment
Our internal control program is designed in alignment with the principles of recognized security and privacy frameworks, including SOC 2, ISO/IEC 27001 and HITRUST CSF. These are statements of alignment, not certifications or third-party attestations. Evidence of specific controls is available under non-disclosure on request.
Questions about this page or our security practices? Contact support@terrasecure.co. For data protection matters, see our Privacy Notice.