EU-region deployment
Regional project location supports data-location requirements.
Security by accountable design
Your GRC records stay separated, attributable and under control.
NeoGRC combines database-enforced tenant controls, role-aware access, accountable workflows and EU-region infrastructure to protect the compliance information entrusted to the platform.
Access architectureProtected request path
Tenant boundary activeUserNamed identity
AuthenticationToken session
AuthorisationRole + scope
Authenticated request
NeoGRC servicesInput validation · controlled workflow · privileged operations
Authorised query
Row Level SecurityDatabase policy decision
Tenant-aware recordsClient ownership enforced
Security at a glance
Controls that answer practical review questions.
Database-enforced tenant policies
Record access is evaluated inside PostgreSQL, not only in the interface.
Role and scope-based access
Permissions narrow access by client, unit, regulation and module.
Encryption in transit and at rest
Transport and managed storage encryption protect platform data.
Attributable decisions
Named-user activity and record history support accountable work.
Configurable recovery
Recovery and monitoring options can match the agreed deployment plan.
Multi-tenant GRC data isolation
One platform. Strictly separated client environments.
NeoGRC’s B2B2B model keeps consultancy oversight explicit while separating each client’s users, business units, regulations, modules and customer-owned records.
ConsultancyExplicitly scoped oversight
Client AA usersA unitsA records
Client BB usersB unitsB records
No horizontal client-to-client path
Every relevant customer record carries tenant ownership.
Database policies evaluate the authenticated user and permitted tenant.
Normal client access cannot request another tenant’s records.
Consultancy access is explicitly scoped by role and client.
Privileged service credentials remain outside the browser.
Policies require automated and manual allow-and-deny testing.
Administrative operations remain controlled and logged.
Row Level Security is a database capability; NeoGRC is responsible for designing, testing and operating the policies that apply it. No isolation control should be treated as infallible.
Defence in depth
Nine boundaries. One traceable request.
Select a layer to inspect it. Use arrow keys to move between layers.
Identity
Named accounts establish who is making a request. MFA and customer identity-provider integration can be added where required.
Sign-in attemptIdentity verifiedNamed account resolvedAccess recorded
Session
Token-based sessions carry authenticated identity. Session handling and expiry apply before protected operations proceed.
Token issuedValidity checkedScope attachedExpiry enforced
Application
Server-side validation, controlled workflows and abuse protections restrict what a request may do.
Input receivedRequest validatedAction authorisedEvent recorded
Database
PostgreSQL roles, least-privilege grants and Row Level Security form a second authorisation boundary.
Query receivedGrants checkedRLS evaluatedRows returned
Tenant
NeoGRC policies compare authenticated identity with consultancy and client ownership before returning records.
User resolvedTenant matchedClient boundary appliedAccess logged
Record
Customer records carry tenant ownership and can be scoped further by unit, regulation, module or role.
Record requestedOwnership checkedFine-grained scopePermitted record
Audit
Named actions, compliance-record changes and human decisions create an attributable operating history.
Action completedActor attributedChange capturedHistory retained
Infrastructure
Managed hosting supplies encryption, monitoring, vulnerability management, DDoS protection and infrastructure logs.
Traffic receivedPlatform protectedService monitoredAlert generated
Recovery
Managed backups, optional point-in-time recovery, versioned releases and tested restores support resilience.
Recovery point chosenRestore initiatedIntegrity verifiedService resumed
Capability availability
Know what is foundational, configured and optional.
Availability remains subject to configuration, deployment plan, contract and shared-responsibility requirements.
Managed capabilities built into the NeoGRC platform foundation.
Managed PostgreSQL database
Managed relational storage for NeoGRC records.
Encryption at rest and in transit
Managed storage encryption and encrypted transport.
Authentication and token services
Identity and session primitives used by NeoGRC.
Database roles, grants and RLS
Database-native tools for granular authorisation.
Platform monitoring and DDoS protection
Controls protecting the managed service layer.
Regional project deployment
Region selection supports data-location planning.
Controls NeoGRC designs, configures, tests and operates.
Tenant-aware data model
Consultancy, client and record ownership in the schema.
Row Level Security policies
Allow and deny rules implement tenant isolation.
Role and scope-based access
Access by role, client, unit, regulation and module.
Privileged credential separation
High-privilege credentials stay outside browser code.
Named decisions and audit history
Work remains attributable to people and records.
Validation, rate limiting and abuse protection
Layered checks reduce malformed and abusive requests.
Retention-aware record handling
Soft deletion, retention and deletion rules preserve context.
Secure deployment and rollback
Versioned releases support controlled change.
Access, incident and supplier reviews
Procedures support ongoing control effectiveness.
Additional controls scoped to customer, plan and contract requirements.
Point-in-time and longer-retention recovery
Recovery windows can expand for eligible deployments.
External log monitoring or SIEM
Platform logs can feed an agreed destination.
MFA and identity-provider integration
Stronger authentication can meet customer requirements.
Network restrictions and SSL enforcement
Database connections can be narrowed and encrypted.
Dedicated compute, replicas and private connectivity
Isolation and scale options depend on the plan.
Enhanced assurance and support
Evidence, testing and support depend on contract and scope.
01Encrypted ingressProtected in transit
02NeoGRC servicesValidated and access-controlled
03Managed data layerEncrypted at rest
Compliance data protection
EU-region hosting supports your data-protection strategy.
NeoGRC combines regional project location with data minimisation, retention and deletion controls, subprocessor review, data-subject request support and contractual data-processing terms.
- Hosting location is agreed for the customer deployment.
- Backup and log locations and retention require review.
- NeoGRC and the customer retain shared responsibilities.
Compliance support
Infrastructure assurance without borrowed certification.
Managed infrastructure assurance
- SOC 2 Type 2 within the provider boundary
- ISO 27001 within the provider boundary
- GDPR-supporting platform capabilities
- HIPAA-capable arrangements where applicable
- Formal provider documentation for eligible plans
NeoGRC responsibilities
- Secure application and tenant-policy design
- Access management and credential handling
- Secure development and incident management
- Retention configuration and vendor oversight
- Customer agreements and independent assurance when completed
NeoGRC does not claim independent SOC 2 or ISO 27001 certification. Infrastructure-provider certifications apply only to that provider’s compliance boundary. They do not automatically certify NeoGRC or a NeoGRC customer.
Authentication and GRC access control
Identity starts access. Scope narrows it.
NeoGRC combines named identity with roles and record context so access can follow how compliance work is divided.
Named user identity
Roles and permissions
Consultancy and client scope
Business-unit scope
Regulation and module scope
Periodic access reviews
Privileged access handling
Human approval for operational changes
Available by requirement
Time-limited access, restricted external-auditor access, MFA and customer identity-provider integration can be configured subject to technical fit, deployment plan and contract. These controls are not represented as enabled for every customer.
Logging and accountability
Different events answer different questions.
User activity identifies who acted. Record history shows what changed. Human decision history records review and approval. Administrative changes and infrastructure logs support operations and monitoring. Retention depends on plan and customer requirements.
Illustrative example — fictional records
A. Rivera
Updated control CTRL-041
J. Chen
Requested evidence review
M. Novak
Approved decision DEC-118
NeoGRC
Recorded version and actor
Backup, resilience and recovery
Recovery controls follow the risk requirement.
No RPO, RTO or uptime commitment is implied unless documented in the customer contract.
Managed backups
Availability and retention follow the selected deployment plan.
Point-in-time recovery
Configurable recovery windows are available for eligible deployments.
Restore and rollback
Restoration testing combines with versioned deployment and rollback.
Additional resilience
Longer retention, replicas and monitoring can be scoped with the customer.
Shared responsibility
Security is operated across three boundaries.
Infrastructure foundation
- Hosted infrastructure
- Managed PostgreSQL service
- Platform-level controls
- Underlying backups
- Provider assurance
NeoGRC
- Application security and tenant model
- RLS policies and role design
- Credential handling
- Monitoring and incident response
- Software updates
Customer
- User lifecycle and assignments
- Appropriate data uploads
- Internal policies and devices
- Timely access reviews
- Regulatory accountability
Security FAQ
Answers for security and procurement teams.
Need the answer applied to your architecture? Request a focused security review.
How does NeoGRC separate consultancy clients?
NeoGRC models the consultancy and each client as distinct scopes. Relevant records carry tenant ownership, and database policies compare that ownership with the authenticated user’s permitted tenants. Consultancy-wide access must be explicitly assigned.
Does NeoGRC use Row Level Security?
Yes. NeoGRC uses PostgreSQL Row Level Security as a database authorisation layer. The technology does not secure tenancy automatically: NeoGRC defines, tests and operates the grants and policies that implement client isolation.
Where is NeoGRC data hosted?
NeoGRC supports EU-region project deployment. The agreed hosting location, backups, logs and relevant subprocessors should be confirmed for each customer deployment and contract.
Is NeoGRC GDPR compliant?
GDPR does not provide a general product certification. NeoGRC is designed to support data-protection obligations through regional hosting, access control, minimisation, retention controls and shared-responsibility processes. Each customer remains responsible for its own lawful use.
Is NeoGRC SOC 2 or ISO 27001 certified?
NeoGRC does not claim independent SOC 2 or ISO 27001 certification. Its managed infrastructure provider maintains SOC 2 Type 2 and ISO 27001 assurance within the provider’s compliance boundary; that assurance does not certify NeoGRC or its customers.
Is data encrypted?
Customer data is encrypted in transit and at rest within the managed platform foundation. Security also depends on correct identity, authorisation, credential and operational controls.
Does NeoGRC support SSO and MFA?
MFA and customer-managed identity-provider integration are available based on customer requirements, technical fit, plan and contract. Availability does not mean a control is enabled for every deployment.
What backup and recovery options are available?
Managed backups follow the selected deployment plan. Point-in-time recovery, longer retention, restore testing and additional resilience can be agreed. NeoGRC does not publish an RPO, RTO or uptime commitment unless contractually documented.
Can an external auditor receive restricted access?
Restricted, time-limited external-auditor access can be configured where required. Scope, permissions, approval and removal should be agreed with the customer.
How can our security team review NeoGRC?
Request a security and architecture review. We can prepare a focused discussion covering tenancy, data flows, access, hosting, logging, retention, recovery and available supplier-assurance material.
Technical review
Bring your security requirements into the conversation.
We can prepare a review of isolation, data flows, access, hosting, backup, logging, retention and supplier documentation.