Security & Trust Center

01 Security Architecture

GSC Identity is built on a Zero Trust model: no request is trusted by default, and access is verified continuously based on identity, context, and policy rather than network location. The platform runs on Microsoft Azure, benefiting from Azure's physical and infrastructure security, with defense-in-depth across the application, data, and network layers.

02 Data Protection

• Encryption in transit — TLS 1.3 for data moving between you and the Services.
• Encryption at rest — stored data is encrypted using industry-standard algorithms.
• Secrets management — connector credentials, API keys, and tokens are stored encrypted and access-controlled.
• Data segregation — customer tenants are logically isolated.

03 Access & Identity

• Role-based access control and least-privilege access to systems and data.
• Multi-factor authentication for administrative access.
• Single sign-on readiness for enterprise customers via standards-based identity.
• Audit logging of authentication events and administrative actions.

04 Monitoring & Operations

• Continuous security monitoring, logging, and alerting.
• Vulnerability management, including regular scanning and patching.
• Secure software development practices and change management.
• Resilient, highly available infrastructure with backup and recovery procedures.

05 Compliance & Frameworks

Our security program is aligned with widely recognized standards, and we design controls to support our customers' own compliance obligations:

• NIST 800-53 — control families mapped across the platform.
• ISO/IEC 27001 — information security management alignment.
• SOC 2 — readiness program with continuous control monitoring.
• HIPAA — safeguards for regulated and healthcare workloads.
• GDPR & CCPA/CPRA — privacy practices described in our Privacy Policy.

Current certification status and reports (including any SOC 2 report and a Data Processing Addendum) are available to customers and prospects under NDA on request.

06 Incident Response

We maintain a documented incident-response program covering detection, triage, containment, eradication, recovery, and post-incident review. In the event of a personal-data breach, we notify affected customers and individuals without undue delay and as required by applicable law and contract.

07 Report a Vulnerability

We welcome reports from security researchers and customers. If you believe you have found a vulnerability, please contact our security team with details so we can investigate. Please act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.