Security at GuardOps

Our approach to security

GuardOps is a workforce-management platform for security companies. We handle sensitive operational data, including guard identities, locations, schedules, patrol and incident records, and client site information, so security and tenant isolation are foundational to how the product is built, not an afterthought.

This page is a plain-language summary of the controls we have in place today and the compliance work in progress. Detailed security documentation is available to customers and prospects under NDA on request.

Data protection

Customer data is protected in transit and at rest:

• Encryption in transit: all traffic between clients and our servers uses TLS/HTTPS. HTTP Strict Transport Security (HSTS) is enforced.
• Encryption at rest: the database and file storage are encrypted at rest by our infrastructure provider.
• Private file storage: guard photos, login selfies, patrol and incident evidence are stored in private buckets and served only through short-lived, signed URLs. Public buckets (e.g. company logos) are limited to non-sensitive assets.
• Payment data: card data is handled entirely by Stripe; we never store card numbers, expiry, or CVV.

Tenant isolation & access control

Every company on GuardOps is logically isolated from every other company:

• Row-Level Security (RLS): database tables enforce company-scoped policies in the database itself, so one company cannot read another company’s data even if an application bug were present.
• Role-based access control (RBAC): admin, manager, supervisor, and guard roles are mapped to a granular permission matrix and enforced server-side on API requests.
• Server-side authorization: sensitive actions are authorized on the server using the caller’s verified identity, never trusting the client alone.
• Least privilege: the privileged service-role key is used only on the server and is never exposed to browsers or mobile apps.

Authentication

• Managed authentication: sign-in is handled by a managed auth provider with secure, HTTP-only session cookies and automatic session refresh.
• Password hygiene: passwords are hashed (bcrypt) and never stored in plaintext; leaked-password protection screens against known-compromised passwords.
• Email verification & secure reset: account confirmation and password-reset flows are token-based and resistant to account enumeration.
• Multi-factor authentication: MFA for administrators is on our near-term security roadmap.

Application & infrastructure security

• Hardened HTTP headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS are set; a Content-Security-Policy is being rolled out in report-only mode ahead of enforcement.
• Parameterized data access: database access uses a parameterized query layer, mitigating SQL-injection risk.
• Input validation: API inputs are validated server-side; we are standardizing on schema-based validation across all endpoints.
• US-based managed hosting: the platform runs on reputable managed cloud infrastructure in the United States.

Monitoring & audit logging

• Security event logging: login verification events (including device and risk signals) are recorded for review, and billing/webhook events are logged with idempotency safeguards.
• Centralized audit trail: we are expanding to a centralized, tamper-resistant audit log covering authentication, role changes, exports, and administrative actions.
• Error monitoring: application errors are captured through a monitoring service for rapid detection and response.

Compliance & SOC 2 readiness

GuardOps is not currently SOC 2 certified, and we do not represent otherwise. We are actively working toward SOC 2 readiness: documenting controls, closing gaps, and organizing evidence in preparation for a future independent audit.

• SOC 2 readiness in progress.
• Security documentation available upon request (under NDA).
• Vendor security questionnaire support available.
• Compliance roadmap available for enterprise customers.

Vendor security reviews

Evaluating GuardOps as a vendor? We support security and procurement reviews. We can provide a current security overview, complete standard vendor questionnaires (e.g. SIG Lite), and walk your team through our controls and roadmap. Contact us to start a review.

Responsible disclosure

If you believe you have found a security vulnerability, please report it to us at security@getguardops.com. We appreciate responsible disclosure and will work with you to validate and remediate confirmed issues. Please do not publicly disclose an issue before we have had a reasonable opportunity to address it.

Contact

Security questions or documentation requests:

Email: security@getguardops.com

General: info@getguardops.com