Security & Trust
Last reviewed: August 2026
GuardKat is designed to protect sensitive reports, case data, and organizational information using modern security practices and enterprise cloud infrastructure.
Because whistleblower reports often contain highly sensitive information, security, confidentiality, and controlled access are fundamental design requirements of the GuardKat platform. We document the controls in place today, improve them continuously, and describe future compliance work as a roadmap rather than a completed certification.
Our approach
Security principles
GuardKat is built around five core principles:
At a glance
Platform security
Our security approach covers the infrastructure that hosts GuardKat, the protection applied to stored and transmitted data, and how authorized users access case information.
GuardKat's core application, database, and storage services are hosted on Microsoft Azure in India.
Sensitive case data and uploaded evidence are protected through multiple layers of encryption. GuardKat applies additional application-level encryption to sensitive information using centrally managed encryption keys. This provides an additional layer of protection beyond infrastructure-level encryption at rest.
Organizations can allow anonymous reporting while still enabling secure two-way communication between authorized reviewers and anonymous reporters.
Case information is accessible only to authorized users assigned appropriate permissions within an organization's GuardKat environment.
Operational assurance
GuardKat applies security practices to uploaded evidence, service continuity, and the way product changes are developed and released.
Documents, images, and supporting evidence uploaded to GuardKat are encrypted and protected by the same access-control rules governing case information.
GuardKat supports secure communication between reporters and authorized reviewers, including anonymous follow-up conversations when anonymous reporting is enabled.
GuardKat utilizes regular backups and recovery procedures designed to help restore service and customer data in the event of accidental deletion, operational incidents, service disruption, or infrastructure failure.
Security is considered throughout the software development lifecycle. Code changes undergo review before deployment, and security improvements are incorporated as part of ongoing product development.
Organizations retain ownership of their data. GuardKat processes customer data solely to provide, secure, and improve the service as described in our contractual terms and privacy commitments.
GuardKat supports multiple languages to help organizations provide accessible reporting experiences across diverse workforces.
Security controls
These controls are documented in our current Privacy Policy and Terms of Service.
Organizations configure roles and permissions so only authorized personnel can view or manage case data.
Access can be limited according to organizational responsibility and case-management needs.
Security and activity events are logged to support accountability and monitoring.
Data is encrypted at rest and in transit.
Organizations administer users, roles, and access within their own GuardKat tenant.
Case information is available only to users with the appropriate assigned permissions.
Compliance & governance
GuardKat does not currently claim ISO 27001 certification. Our roadmap describes planned alignment and readiness work, not completed certification.
Data residency
GuardKat's core application, database, and storage services are currently provisioned within Microsoft Azure Central India. Material changes to processing or storage locations will be communicated to organizations.
Primary region
Azure Central India
Frequently asked questions
GuardKat currently hosts customer data within Microsoft Azure Central India.
Yes. Organizations can enable anonymous reporting while still allowing secure two-way communication between reporters and authorized reviewers.
No. GuardKat does not sell customer data or personal information.
Yes. Data is encrypted in transit and at rest. Sensitive information is also protected using application-level encryption and centrally managed encryption keys.
GuardKat does not currently claim ISO 27001 certification. Security and compliance alignment activities are part of our ongoing roadmap.
Security contact
Contact us about a potential security issue, our privacy practices, or compliance questions. Please do not include sensitive report or case details in an initial email.
If you believe you have discovered a security vulnerability in GuardKat, please contact security@guardkat.in. We appreciate responsible disclosure and will investigate all legitimate reports.
Security emails are monitored by the GuardKat team and reviewed as a priority.