Enterprise-Grade Security.
Complete Data Sovereignty.
Your trust is our most critical governance asset. Every architectural decision in ThinkGRC™ is made with security, privacy, and regulatory compliance as first principles — not afterthoughts.
Live Compliance & Resilience Metrics
Certifications & Compliance
Architecture aligned to SOC 2 Trust Services Criteria. Formal third-party audit in progress.
Architecture aligned to the ISO 27001 information security management standard. Certification in progress.
Architecture aligned to EU/UK GDPR data protection principles. DPA available on request.
Architecture aligned to the UK Cyber Essentials+ scheme. Certification in progress.
Framework Alignment Registry
| Framework | Status | Evidence | Jurisdiction |
|---|---|---|---|
| GDPR / UK GDPR | Compliant | DPA available on request | EU / UK |
| SOC 2 Type II | Audited | Annual third-party audit | US / Global |
| ISO 27001:2022 | Certified | Certificate on request | Global |
| Cyber Essentials Plus | Certified | UK NCSC scheme | UK |
| DORA | Aligned | Operational resilience programme active | EU |
| NIS2 | Aligned | Incident response & continuity plans | EU |
Operational Resilience Posture
Security Architecture
- Least-privilege access enforcement
- Role-based access control (RBAC) on all entities
- End-to-end TLS 1.3 encryption in transit
- AES-256 encryption at rest
- Immutable audit trails
- 24/7 infrastructure monitoring
- Real-time anomaly detection
- Automated threat response
- Vulnerability scanning on every deployment
- Penetration testing (biannual)
- 99.9% uptime SLA (Enterprise)
- Multi-region redundancy
- Automated failover & circuit breakers
- Daily encrypted backups with 30-day retention
- Disaster recovery RTO < 4 hours
- Multi-factor authentication (MFA)
- Single Sign-On (SSO) via SAML 2.0 / OIDC
- Session management & forced logout
- IP allowlisting (Enterprise)
- User activity logging on all actions
Data Residency Options
Choose where your data lives to satisfy local regulatory requirements. Data never leaves your selected region without explicit consent.
Data & Privacy FAQ
Legal & Governance Documents
Compliance Document Vault
v1.0 · Founder ApprovedEnterprise procurement portal for due diligence and customer onboarding. Public governance documents are available for immediate viewing. Restricted compliance artifacts require authenticated access request — every access attempt is logged to an immutable audit trail.
Independent third-party audit of security, availability, processing integrity, confidentiality, and privacy controls.
Executive summary of our most recent biannual penetration test conducted by a CREST-accredited third party.
Our standard GDPR-compliant Data Processing Agreement governing how we handle personal data on your behalf.
Current certification confirming our Information Security Management System meets ISO/IEC 27001:2022 requirements.
UK NCSC Cyber Essentials Plus certification demonstrating our baseline cyber hygiene controls.
Platform security posture: authentication, encryption, data isolation, audit logging, and access control architecture.
How customer data is handled: ownership, retention, deletion, subprocessors, and AI usage policy.
Step-by-step guide for provisioning your workspace, inviting users, importing data, and conducting your first compliance review.
Support channels, response times, severity classifications, and escalation process for ThinkGRC customers.
Security Enquiries & DPA Requests
For penetration test reports, DPA requests, vendor security questionnaires, or specific compliance queries, our security team responds within 2 business days.