Security at GuardenerAI

GuardenerAI was hardened in healthcare first, where data has to be spotless and protected. The practices below apply to every customer on the platform today.

Encryption everywhere

• In transit. All traffic is served over TLS 1.2+ with automatically managed certificates. There is no unencrypted access path.
• At rest. Databases, file storage, and disk volumes are encrypted at rest on AWS.
• Application secrets. Credentials and per-tenant integration secrets are envelope-encrypted with dedicated AWS KMS keys and managed through AWS Secrets Manager; they are never stored in plaintext.

Tenant isolation

Every customer workspace lives in its own isolated database schema. Queries are scoped to your tenant by construction, and tenant subdomains are bound to your workspace at the edge.

Access control

• Default-deny authorization. Every API endpoint must declare the role it requires; anything unannotated is rejected automatically, and a build-time check enforces coverage.
• Role-based access. Viewer, member, and admin roles inside your workspace, with platform roles fully separated from tenant roles.
• MFA. Multi-factor authentication with trusted-device management and revocation on credential change.

Audit trail

Security-relevant actions and record changes are written to an append-only audit log that cannot be quietly edited, with change-source attribution for automated and AI-driven edits.

AI data handling

The built-in assistant runs against your workspace only, inside our AWS environment (Amazon Bedrock). Your data is not used to train third-party foundation models, and per-tenant AI credentials are isolated and KMS-encrypted.

Infrastructure and resilience

• Hosted on AWS in the United States, with the production database running Multi-AZ with automated backups.
• Secrets are fetched at boot from AWS Secrets Manager; nothing sensitive is baked into images.
• Infrastructure health is continuously monitored, with a public health endpoint at /healthz.

Compliance roadmap

GuardenerAI is built with healthcare-grade practices, and HIPAA compliance (including BAAs) and SOC 2 Type II are on our active roadmap. If you need to store regulated health information, talk to us first so we can discuss timing and the right agreement before you onboard that data.

Reporting a vulnerability

If you believe you've found a security issue, email hello@guardenerai.com with the details. We read every report and will respond promptly.