What does GuardStance inspect?

Files, messages, uploads and AI prompts on the channels your policies cover. Content is checked where it moves, and the decision is made there. Channels you do not switch on are not inspected.

Events: what was detected, which rule matched and why, the user, the destination and the action taken. Content is kept only when a policy asks for it as evidence. Events are signed, so any later change shows.

On-premises editions keep everything inside your network, and nothing leaves unless you choose to send it. In managed editions the data lives in the service’s hosted store, in a region agreed with you before deployment.

The people you give a console role. Access is role-based, and auditors can see reports without seeing raw content. Every administrator action is recorded in the console’s own audit log.

Which components run inside your network?

In the on-premises edition, all of them: the endpoint agents, the policy server with its console, and the evidence store. In managed editions the endpoint agents run at your site and the policy server is hosted for you.

How long is data kept?

Events, discovery scan history and daily summaries are kept for 400 days by default, and the audit log for 24 months. Your organization can shorten these periods. The reasoning is in a retention document we share during evaluation.

Trust Center

Security Transparency Matters

Security teams should never have to guess what a security tool inspects, stores, or sends over the network. The GuardStance Trust Center documents exactly where our components run, what incident records hold, how long logs are kept, and how your data stays under your control.

Book a demo

On-premises

your network

Endpoint agents
Policy server and console
Evidence store

Managed

your network

Endpoint agents

hosted region

Policy server and console
Evidence store

Six questions, answered

What does GuardStance inspect?

Files, messages, uploads and AI prompts on the channels your policies cover. Content is checked where it moves, and the decision is made there. Channels you do not switch on are not inspected.
What does it store?

Events: what was detected, which rule matched and why, the user, the destination and the action taken. Content is kept only when a policy asks for it as evidence. Events are signed, so any later change shows.
Where is it stored?

On-premises editions keep everything inside your network, and nothing leaves unless you choose to send it. In managed editions the data lives in the service’s hosted store, in a region agreed with you before deployment.
Who can access it?

The people you give a console role. Access is role-based, and auditors can see reports without seeing raw content. Every administrator action is recorded in the console’s own audit log.
Which components run inside your network?

In the on-premises edition, all of them: the endpoint agents, the policy server with its console, and the evidence store. In managed editions the endpoint agents run at your site and the policy server is hosted for you.
How long is data kept?

Events, discovery scan history and daily summaries are kept for 400 days by default, and the audit log for 24 months. Your organization can shorten these periods. The reasoning is in a retention document we share during evaluation.

Request security documents

Tell us which documents your review needs. We send what applies to your edition and setup.

Name

Work email

Company

Country

Which documents do you need, and why?

We use these details only to answer you. See our privacy policy.

This form needs JavaScript. You can also email us at sales@guardstance.com.

See it on your own data.