Compliance

Safeguard is built for enterprise compliance requirements, with an architecture designed for FedRAMP HIGH and IL5, and comprehensive regulatory support.

Coverage at a glance

Safeguard's framework library has national data-protection, cybersecurity and sector laws from every region, industry standards such as SOC2, ISO/IEC 27001 and PCI DSS, and Safeguard's own supply-chain policies. For each framework, Safeguard checks a set of requirements when it scans your products, lists the framework's controls and offers policy templates. For SOC2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0 it also maps automated tests from the systems you connect.

• Compliance frameworks: how Safeguard covers a framework, what a readiness score counts, how to choose your frameworks, and a page for every framework.
• All frameworks: the full list on one page, by region.
• Connectors: every connector, and whether it collects evidence automatically. How to connect one: Compliance connectors.
• Frameworks and connectors: which connectors provide evidence for which framework.
• Trust Center setup: publish your posture to customers.
• Requests and approvals: the requests your programme handles and the decisions that wait for a person.

Compliance posture

Safeguard does not currently hold a FedRAMP authorization and is not listed on the FedRAMP Marketplace. The sections below describe what the platform's architecture is designed to, not authorizations it has been granted.

FedRAMP HIGH

Architecture designed to FedRAMP HIGH requirements:

• Continuous monitoring
• Annual assessments
• Incident response procedures
• Security control implementation

IL5 (Impact Level 5)

Designed for Department of Defense deployment requirements:

• Classified information handling
• Enhanced security controls
• DoD-specific requirements

SOC2 Type 2

SOC2 Type 2 audit in progress, covering:

• Security
• Availability
• Confidentiality
• Processing Integrity

EO 14028 Support

Executive Order 14028 compliance features:

SBOM Requirements

• NTIA minimum elements
• SPDX and CycloneDX formats
• Automated completeness checking
• Compliance scoring

Software Security

• Vulnerability disclosure
• Secure development practices
• Supply chain security
• Artifact signing

Regulatory frameworks

The framework library is grouped by region: Americas, Europe, Asia-Pacific, Middle East & Africa, International, and Safeguard's own internal policies. Each framework's page says what a scan checks for it, which requirements a scan decides and which need your evidence, and lists its controls, its policy templates and its automated tests.

Compliance Reports

Generate compliance documentation:

Pre-Built Reports

• FedRAMP POA&M support
• EO 14028 compliance report
• SBOM completeness audit
• Vulnerability summary

Custom Reports

Create reports for specific requirements:

1. Navigate to Reports
2. Click Create Report
3. Select compliance framework
4. Configure scope and date range
5. Generate and export

Data Residency

Deployment options for data residency:

• US Cloud - US data centers only
• EU Cloud - EU data centers only
• On-Premises - Your infrastructure
• Air-Gapped - Disconnected environments

Security Architecture

Multi-Tenant Isolation

• Complete tenant separation
• Dedicated encryption keys
• Isolated compute resources
• Network segmentation

Encryption

• TLS 1.3 in transit
• AES-256 at rest
• Customer-managed keys option
• Hardware security modules

Access Control

• Role-based access (RBAC)
• Single Sign-On (SSO)
• Multi-factor authentication
• API key management

Audit Support

Supporting your audits:

• Complete audit trails
• Evidence collection
• Assessor access (read-only)
• Documentation packages