Security
Built for the controls
your security team requires.
GridStrong holds the compliance and modeling record for critical infrastructure. We have passed the cybersecurity reviews of, and hold service level agreements with, some of the largest utilities and system operators in North America. Single sign-on with multi-factor authentication on every sign-in. Encryption everywhere. Model runs that never share an environment. An audit trail on every action.
Platform security
Built on infrastructure your security team already trusts.
US cloud, one provider
The Dashboard and every customer record live in GridStrong's Amazon Web Services environment in the United States, in locations covered by SOC 2 or similar attestations. The provider's current SOC 2 Type II report is available on request.
Nothing moves in the clear
All traffic is HTTPS only, TLS 1.2 and 1.3 with HSTS, behind a single internet-facing load balancer. Data stores sit in private subnets with no internet route and are encrypted at rest.
One fresh virtual machine per run
Every simulation runs in a fresh, isolated virtual machine created for that single run and destroyed when it finishes. No customer data persists on execution hosts, and no two customers' models ever share an environment.
Daily, 24-hour recovery point
Full off-site backups every day with a 24-hour recovery point objective, exercised under the Disaster Recovery and Business Continuity Manual.
Rebuilt from scanned images
Containers are rebuilt from versioned, scanned images on every deployment. Threat detection analyzes account, network and DNS telemetry continuously.
Automated processing, no prompts
Document processing runs as automated, pre-programmed backend operations, under written zero data retention terms with any model provider and API access only. No chatbot and no free-form prompt.
Access and control
You decide who sees what. Every action is recorded.
Single sign-on, MFA on every sign-in
Federation to your identity provider, including Microsoft Entra ID and Okta over SAML 2.0, is a configuration step. Multi-factor authentication is required on every account.
Role-based, down to the plant
Access is role-based by department, function and asset. An engineer sees the plants and studies assigned to them and nothing else; your administrators manage the roles.
Who did what, and when
Every action in the Dashboard is logged with the user and the time, for your auditors as much as ours, and exportable with the evidence it refers to.
Handled as critical infrastructure information
Critical Energy Infrastructure Information is handled with CEII-aware access controls and permissioning by plant, so a document is visible only to the people cleared for that site.
Yours, and only yours
Customer data is never shared between tenants. Export everything at any time; the record is yours when the engagement ends.
A direct line to the engineers
Security questionnaires, architecture walkthroughs and policy requests go to the people who built the platform, with the package returned under NDA in three business days.
Policy library
Twenty-two policies. One request.
The full text of every policy is available to customers and prospects under NDA, delivered as one package with the architecture notes and the subprocessor list. Twelve of the twenty-two are summarized below so your review can start before the paperwork does.
Swipe for the full table
| Policy | What it covers | Reviewed | Version | Access |
|---|---|---|---|---|
| Information Systems Security Plan | The governing security program: roles, controls, access, logging, incident response, change and audit management. | Annually and on change | 2H2026 | Request under NDA |
| Risk Management Policy | How risks to systems, data and operations are identified, scored, treated and reviewed. | Annually and on change | 2H2026 | Request under NDA |
| Vendor Management Policy | Due diligence, contracting and ongoing review for every vendor that touches company or customer data. | Annually and on change | 2H2026 | Request under NDA |
| Backup Policy | Daily full off-site backups, retention, restore testing and the 24-hour recovery point objective. | Annually and on change | 2H2026 | Request under NDA |
| Disaster Recovery and Business Continuity Manual | The contingency plan: roles, communications, recovery steps and the periodic exercises that prove them. | Annually and on change | 2H2026 | Request under NDA |
| Secure Coding Standard (Web Application) | Input handling, authentication, session management, dependency and secrets hygiene for the Dashboard codebase. | Annually and on change | 2H2026 | Request under NDA |
| AI/ML Usage Policy | Approved tools, zero data retention requirements, API-only access and the rule that no customer data trains any model. | Annually and on change | 2H2026 | Request under NDA |
| Service Level Agreement | Availability targets, patch and vulnerability timelines, support response and maintenance windows. | Annually and on change | 2H2026 | Request under NDA |
| Password Policy | Password strength, rotation, storage and the multi-factor requirement on every account. | Annually and on change | 2H2026 | Request under NDA |
| Acceptable Use Policy | Expectations for use of the platform, email, internal systems, networks and company assets. | Annually and on change | 2H2026 | Request under NDA |
| Employee Code of Conduct | Conduct, confidentiality, conflicts of interest and how concerns are reported. | Annually and on change | 2H2026 | Request under NDA |
| Supplier Code of Conduct | Minimum conduct and compliance standards for suppliers, contractors and other third parties. | Annually and on change | 2H2026 | Request under NDA |
Boundaries
What GridStrong does not touch.
GridStrong is an engineering record and study platform, not an operational system. It does not connect to, monitor or operate industrial control systems, SCADA, DCS or plant equipment, and holds no credentials to any customer operational network. The service is delivered remotely from the United States by US-based personnel, who administer it only from company-managed endpoints with full-disk encryption, host firewall and multi-factor authentication.
- No OT access, no plant network credentials, no remote control of equipment
- Files and models come in through the Dashboard or an API integration the customer controls
- Customer data stays inside the customer's own tenant; GridStrong engineers reach it only for the engagement, and every access is logged
Request
The security package, under NDA, in three business days.
One request returns the full policy set, the architecture notes, the subprocessor list and the certificate of insurance. Send your own questionnaire with it and an engineer returns it completed.
help@gridstrong.ai, attention Office of the Chief Technology Officer. Report a vulnerability the same way; we acknowledge within one business day.
Your reviewer has questions. Put them to an engineer.
A working session with the people who built the platform, on the architecture, the controls and your questionnaire.