Trust Center
Security is what we do. Transparency is how we do it.
As a Product Security company, we hold ourselves to the highest standard when it comes to security. This page outlines how we protect your data, our compliance posture, and the practices that keep our platform secure.
Security
How we protect your data
Security is embedded in everything we build and operate. We apply rigorous controls across every layer of our platform to keep your data safe.
Encryption
All data in transit is encrypted using TLS 1.2 or above with TLS 1.3 preferred. All data at rest including databases, backups and file storage is encrypted using NIST-recommended cryptographic algorithms such as AES-256.
Key Management
Encryption keys are securely managed through a dedicated key management service with restricted access. Secrets are stored in a centralized secrets manager. Keys are rotated regularly and immediately upon suspected compromise.
Infrastructure Security
All code and infrastructure changes are scanned for security vulnerabilities prior to deployment and shipped through automated pipelines with a full audit trail. Infrastructure is provisioned using infrastructure-as-code and production environments are hardened with tightly restricted access. Primary infrastructure is hosted on Google Cloud within the EU.
Data Isolation
Multi-tenant SaaS environment with logical separation. Each customer's data is isolated and access is enforced at every layer of the stack. Customer source code is temporarily processed during scans and then discarded.
Authentication & Access Control
Role-based access control (RBAC) across all systems with the principle of least privilege. MFA is enforced for all accounts, supporting FIDO2/WebAuthn, authenticator apps, and passkeys. Email, SMS and phone-based factors are avoided, and access to sensitive systems requires re-authentication at least every 24 hours.
Vulnerability Management
Source code, dependencies and version control configuration are scanned automatically at least every 24 hours, and cloud services are continuously monitored for misconfigurations. We enforce strict remediation SLAs: Critical within 1 day, High within 7, Medium within 30, and Low within 90 days.
Logging & Audit
Both application and database level operations are logged, including all privileged actions. Admin audit logs are retained for 400 days and general logs for 30 days. Logs are stored with strict access controls to prevent tampering.
Input Validation & API Security
All inputs are validated and outputs are encoded to prevent common injection attacks. API access uses per-user API keys. Web login supports authentication with SAML SSO (Okta, Google, Microsoft).
Supplier Management
All third-party suppliers and subprocessors are vetted before onboarding and bound by written agreements covering data handling, access restrictions and audit rights. Critical suppliers are reviewed annually.
Compliance
Standards and certifications
We are committed to meeting the compliance requirements our customers depend on.
GDPR
Gardera is EU-based and fully GDPR compliant. Our Data Processing Agreement (DPA) forms part of every customer agreement and is governed by Swedish law. We assist customers in fulfilling data subject requests including access, rectification, erasure, restriction, portability, and objection, and customers may audit our processing annually.
ISO 27001
Our Information Security Management System (ISMS) is aligned with ISO 27001 requirements. We are working towards formal certification.
SOC 2 Type I & II
We are planning to pursue SOC 2 Type I & II certification to independently validate our security controls across availability, confidentiality, and processing integrity.
Data Handling
Your data, your control
Full transparency about how your data is processed, stored, and protected.
Data Residency
Customer data is stored and processed within the European Economic Area (EEA). Primary infrastructure is hosted on Google Cloud in European regions. Where a listed subprocessor processes data outside the EEA, transfers are covered by Chapter V GDPR safeguards such as an adequacy decision or Standard Contractual Clauses. Customers who require it can opt in to an EEA-only processing configuration.
Data Retention & Deletion
Customer data is retained for the duration of the service agreement. Upon termination, customers may request data in a machine-readable format. Data is then securely deleted from all systems, including subprocessors, within 30 days. Evidence of deletion can be provided upon request.
Source Code Handling
Source code is temporarily stored only to perform scans and is then discarded. During analysis, source code, scan results and vulnerability data may be sent to the AI subprocessors listed below solely to return results to you. Only security findings, metadata, and asset information persist for the purpose of delivery of the service.
No Training on Your Data
Customer data is never used to train or fine-tune AI models. We may use anonymized and aggregated data for statistics and benchmarking without the customer's identity being identifiable. Production data containing sensitive information is not used in testing environments.
Subprocessors
Third-party data processors
All subprocessors are bound by written agreements with data protection obligations equivalent to our DPA. Customers are notified at least 14 calendar days before any subprocessor is added or replaced and may raise objections within that period. We conduct annual reviews of critical suppliers.
| Provider | Location | Purpose |
|---|---|---|
| Google Cloud | EU | Cloud infrastructure, hosting and storage |
| Google Cloud (Gemini models) | EU and global | AI-assisted analysis (model inference). Not used for model training. |
| Neo4j | EU | Graph database hosting |
| PostHog | EU | Product analytics |
| Cloudflare | Global | Network, security and edge compute (Cloudflare Workers). Requests are processed in the data center closest to the user. |
| Opper Technology AB (Sweden) | EU and global | AI model gateway routing requests to model providers selected by Gardera. Not used for model training. EEA-only routing available on request. |
Through Opper, customer data is routed only to model providers that are contractually prohibited from using it to train their models. Some model providers may temporarily retain request content solely for abuse monitoring, typically for up to 30 days, before deletion. Opper's own platform subprocessors are listed at opper.ai/sub-processors.
AI Usage
How we use AI
Gardera uses AI for risk prioritization, contextualization, and remediation recommendations. Customer data is never used to train or fine-tune any models.
LLM-Agnostic Architecture
Gardera is LLM-agnostic and not tied to any single model provider. Models are accessed through Google Cloud (Gemini) and the Opper model gateway, and we only work with providers that are contractually prohibited from training on customer data. EEA-only model routing is available on request. We do not train or fine-tune any models ourselves, and customer data is never used for model training or improvement.
Agentic AI
The platform supports agentic AI capabilities where agents are heavily guided to follow a defined methodology. Agents use custom tools with no external integrations.
Incident Response
How we handle security incidents
We are committed to rapid, transparent communication in the event of any security incident.
Breach Notification
We commit to notifying customers within 24 hours of becoming aware of a data breach affecting customer data. Notifications cover the nature and scope of the breach, the data and data subjects affected, likely consequences, and the measures taken to mitigate it.
Ongoing Communication
We provide ongoing status updates until a breach is fully resolved and perform post-incident reviews to identify root causes and corrective actions.
Security Contact
Our security team is available for urgent matters. All employees have the necessary security competence to respond to incidents.
Personnel
People and access
Security starts with the people who build and operate the platform.
Background Checks
All current and future employees are subject to background checks, including criminal records. All employees are bound by strict Non-Disclosure Agreements (NDAs).
Security Expertise
All employees have strong security backgrounds and the necessary competence to respond to security incidents. Security awareness training is embedded into onboarding for all new hires.
Access Revocation
Upon termination of employment, all access rights are revoked immediately. Shared credentials are not permitted or used internally. Sensitive actions are reserved for service accounts belonging to deployment pipelines.
Device Security
All employee devices require full disk encryption, strong authentication and automatic screen locking. Passwords are at least 14 characters and stored in a password manager, and are changed immediately if a compromise is suspected.
Policies
Documentation and policies
Review our policies and legal documents. Contractual documents are shared upon request.
Still have questions?
Our team is happy to answer questions about our security practices, provide additional documentation, or discuss your specific compliance requirements.
Contact Security Team