Security & Trust

You're trusting Gray Warden with the data behind your compliance posture. Here's how we protect it.

Access Control & Isolation

  • Role-based access control on every action
  • Granular access at the binder, control, and document level
  • Multi-factor authentication included on every plan, via authenticator app or email code, with backup codes
  • SAML 2.0 single sign-on with just-in-time provisioning (Enterprise, coming soon)

Encryption & Key Management

  • Data encrypted in transit (TLS 1.2+) and at rest (AES-256), with encryption keys held in FIPS-validated hardware security modules
  • Keysafe (Enterprise, coming soon): your organization holds and manages its own encryption keys for data at rest
  • Refresh-token rotation on every session
  • Idle and absolute session timeouts enforced

Evidence & File Safety

  • Every uploaded file is scanned for malware before it's accepted
  • Files are streamed through the platform, with no public file URLs
  • Evidence expiration tracking flags stale artifacts

External Assessor Access

  • Assessors get read-only access scoped to a single engagement
  • MFA is enforced for every external auditor, regardless of tenant policy
  • Credentials expire automatically when the engagement ends
  • Every assessor action is captured in an access log

Audit & Accountability

  • Change history on controls, evidence, tasks, and documents
  • Each entry records who made the change, what changed, and when
  • Filterable document audit trail with CSV export

Methodology You Can Trust

  • Assessments built on NIST 800-171A / 800-53A objectives
  • SPRS scoring aligned to the DoD methodology
  • Curated, transparent cross-framework mapping library

Note: Gray Warden is a compliance management platform, not a certification body and not a legal advisor. Using Gray Warden does not guarantee CMMC certification. You remain responsible for your compliance program and should engage a qualified assessor for official certification.

Built Security-First for the DIB

Start your free trial, or talk to us about your specific security requirements.

Start Free TrialTalk to Us