GlassBox Risk is built on a SOC 2 Type II and ISO 27001 certified platform, with application-layer controls designed specifically for public-sector vendor risk management. Here's a transparent look at how your data is protected.
Independently audited
Report available under NDA
Information security management
Certification available on request
EU data protection
Data Processing Agreement available
Payment card industry
Certified payment processing
All data tables and private apps are encrypted at rest and in transit using industry-standard protocols.
Vendor evidence and contracts are stored in private encrypted storage with time-limited signed download URLs — never exposed as public links.
All URL fields (trust portals, supporting docs) require https:// validation at the application layer.
Email/password, OTP verification, Google OAuth, and password reset flows are handled by the platform-managed auth backend.
Every data entity enforces row-level security scoped to the user's organization — users cannot read or write another tenant's records.
A tiered role hierarchy (administrators, contributors, and viewers) governs read, write, and delete permissions per entity, so the right people see the right data.
Access is scoped per entity and per organization. Contributors cannot escalate their own privileges, and write access is tightly bounded to each user's assigned role.
Digital NDA acceptance records capture user ID, timestamp, and IP address, with versioned content and force re-sign on publish.
Composite risk scores are snapshotted at decision time and never rewritten — historical assessments remain auditable.
Formal risk treatment decisions (accept, mitigate, transfer, reject) are logged with reviewer and approver attribution.
Uploaded evidence is reviewed with claim determination, confidence scoring, and reviewer attribution — not just stored.
Our structured control library maps vendor capabilities to the recognized standards that matter most to public-sector procurement teams.
We believe trust is built through honesty. These are the boundaries of our current posture.
Data is encrypted at rest and in transit, but not end-to-end — the hosting platform can access app data under support or administrative scenarios.
App data is stored in the United States. EU/UK residency is available on Enterprise plans for new apps.
SOC 2 Type II and ISO 27001 certifications belong to our hosting platform, not GlassBox Risk directly. Reports are shared under NDA.
We welcome responsible disclosure of security vulnerabilities. If you believe you've found a security issue, please contact us through our contact page with full details so we can investigate and respond promptly.