Built for the standards government holds you to.
Government CIOs, CTOs, and CISOs evaluate vendors on evidence, not adjectives. Here is how Advanced GRC protects your data — the attestations we hold, where your data lives, and the controls behind our SaaS platforms.
At a glance
- SOC 2 Type IIIndependent, unqualified report
- FedRAMP Pre-Gap Assessment Report CompletedA readiness milestone — not a FedRAMP authorization
- US data residencyAll SaaS data resides in the United States
- Encryption at rest & in transitAES-256 at rest; TLS in transit
- MFA for all users, RBAC, SSOMicrosoft Entra ID identity
- 24×7×365 monitoringCentralized SIEM, managed SOC
- 99.9% availability targetGeo-redundant, tested disaster recovery
Verified by third parties — not just asserted.
These are Advanced GRC's own attestations, earned through independent assessment.
SOC 2 Type II, unqualified
An independent CPA firm verified that our security controls were appropriately designed and operated effectively across the audit period, with no material exceptions. It is one of the strongest independent assurances a software organization can provide.
The full report is available to evaluating agencies under NDA.
FedRAMP 3PAO readiness assessment
An accredited Third-Party Assessment Organization — the same type of assessor used in full FedRAMP audits — evaluated our environment against the FedRAMP security controls.
This is a readiness milestone. It is not a FedRAMP authorization, which is a separate, verifiable status.
You know where your data lives.
Advanced GRC runs as SaaS on a hybrid cloud — Microsoft Azure and Oracle Cloud Infrastructure — with the application environment owned and managed by AGRC.
US data residency
All data for our SaaS products resides in the United States. For customers outside the U.S., Azure and OCI regions let us keep data resident in the local jurisdiction where required.
Redundant by design
Hosted across Azure and OCI with geographic redundancy and cloud-native replication, so a single facility or region is never a single point of failure.
Isolation options
Customer data is logically isolated by default. Where a program requires stronger separation, dedicated single-tenant deployments are available.
The controls behind the platform.
Encryption
Data encrypted at rest (AES-256) and in transit (TLS). Encryption keys are managed within the cloud platforms.
Identity & access
Multi-factor authentication is mandatory for all users. Role-based access control and SSO via Microsoft Entra ID, with periodic access reviews.
Monitoring & response
24×7×365 monitoring through a centralized SIEM and a managed security operations capability, with continuous event escalation.
Testing & assurance
Independent penetration testing annually by a certified third party, and vulnerability assessments performed quarterly.
Resilience & recovery
Backups every four hours with 15-day retention on geo-redundant storage. RPO of 4 hours, RTO under one business day. Disaster recovery tested in 2025.
Availability
A 99.9% availability target, excluding scheduled maintenance — backed by the redundant, tested architecture above.
Request our security documentation.
Our SOC 2 Type II report, penetration-test summary, and full security package are available to evaluating agencies under NDA. Tell us what your review requires and we'll get it to your team — and we're glad to complete your security questionnaire directly.
Bring your security review to us.
Tell us what your team needs to evaluate. A real person from our team — not a form auto-responder — will follow up.
Shared only with our team for this request. A real person replies — typically within one business day.