The regulation requires a CRM. We’re going further.

A request to Garde1 passes through five named control stages before it ever touches your data — and every change leaves an audit record on the way out. Each stage groups the controls that operate there.

1 — Edge

HTTPS only, behind a CDN. Cloudflare fronts the app, the API and garde1.com, with Amazon CloudFront behind it. Plain HTTP redirects.

2 — Identity

Cognito sign-in, Garde1-side MFA, short sessions. OIDC through Amazon Cognito with Microsoft, Google and per-organization SAML; Garde1 serves SCIM itself. A Garde1 gate demands a TOTP or single-use backup code before any session exists, whatever the identity provider asserted. Access tokens live 15 minutes; sessions at most 8 hours.

3 — Tenancy

Two independent layers of isolation. Every database transaction is scoped to the caller's organization, and Postgres row-level security is forced on about 190 tables, so a query has to satisfy both to return a row. ECS tasks use scoped IAM roles; production credentials live in AWS Secrets Manager, never in code.

4 — Data

Validated on ingest, isolated per organization, encrypted at rest. Connector evidence is authenticated to its organization, schema-checked against the vendor and control mapping, then tenant-tagged behind the same row-level security as every read. Aurora PostgreSQL is encrypted with an AWS KMS key, requires TLS, and accepts connections only from Garde1's services and one allowlisted administrator address. Document buckets block public access. Connector credentials sit in Secrets Manager, not the database.

5 — Trail

Append-only audit log, backups, public status. Every state-changing action lands in an append-only log kept seven years with deletion protection and 35-day point-in-time recovery, which Aurora has too; the documents bucket is versioned. Every monitored endpoint and worker reports in real time at status.garde1.com.

Each phase below has a defined trigger and a measurable outcome. Shipping each one is how we prove our security posture isn't aspirational.

1. Phase 1Today

   FedRAMP Moderate AWS, US region

   The platform runs on FedRAMP Moderate-authorized AWS services in us-east-2. Your data is encrypted at rest, the database isolates rows per organization, every sign-in requires a second factor (authenticator app or backup code), vendor credentials live in AWS Secrets Manager, and every change lands in an append-only audit log kept seven years. Garde1 never asks for or holds CUI — these controls protect your scope, evidence, and connector credentials.

2. Phase 2Planned

   AWS GovCloud (US) tenancy

   A dedicated aws-us-gov partition deployment for customers whose contracts demand U.S.-person-only operator access and a GovCloud-resident control plane.

3. Phase 3Planned

   FedRAMP 20x authorization

   Full-system authorization through the streamlined FedRAMP 20x process. The GovCloud tenancy from Phase 2 is the assessment boundary; the building blocks are already authorized. This phase wraps the composed platform in its own package.