Short answer: ask for the audit report, then check five things: what is audited, where your data runs, how people sign in, how the vendor handles your data, and whether you can choose your deployment. Safeguard publishes these answers: SOC 2 Type I and Type II audited, with the report available on request through the Trust Center at safeguard.sh/security.
Why reviews drag on
Before a security tool goes into production, someone has to review the vendor. The questionnaire is long and the answers are scattered across a website, a PDF and a sales call. A vendor that cannot say where data lives, how people sign in or what is audited loses weeks in review, and sometimes the deal.
You can shorten the review by asking the right questions in the right order.
The steps
- Ask for the report first. A current SOC 2 report tells you what was audited, over what period and with what exceptions. Read the scope and the exceptions, not only the cover letter.
- Read the claim exactly. "Audited" and "certified" mean different things, and so do "designed for" and "authorized". Note which words the vendor uses. For FedRAMP, ask whether the architecture is designed for it or whether the vendor holds an authorization.
- Check where your data runs. Ask which regions are offered and which one your tenant will use. If you need a government region, a European region, a private VPC, on-premises or a fully air-gapped deployment, ask whether each is available today.
- Check how people sign in. Look for single sign-on with SAML 2.0 or OpenID Connect, role-based access and two-factor authentication.
- Check the network posture. Ask whether the vendor needs inbound connections to your environment, and how communication is encrypted.
- Check data handling. Ask whether your code, SBOMs and telemetry are used to train shared models, how tenants are isolated, and whether a local runner can keep source on your machines.
- Check the AI choices. Ask whether the product can run with no language model in the loop, with your own approved model, or with the vendor's models inside your environment.
- Write it down. Keep the answers, the report and the date in your vendor register so the next review starts from what you already know.
Questions worth adding to your questionnaire
Most templates ask whether a vendor has a policy. Better questions ask how the vendor proves it. Ask for the period the audit covered. Ask how an administrator removes a former employee's access, and how fast that takes effect in practice. Ask how the vendor handles an incident, who tells you and by what channel. Ask what happens to your data when you leave. And ask which of the vendor's claims are architecture goals and which are things a third party has already audited, because the two are easy to blur.
What Safeguard answers
- Audit: SOC 2 Type I and Type II audited. Reports are available on request through the Trust Center at safeguard.sh/security.
- FedRAMP: the architecture is designed for FedRAMP High requirements.
- Regions: SaaS in US, EU (Frankfurt) and Gov regions, or a private VPC, on-premises or fully air-gapped deployment.
- Sign-in: SAML 2.0, OpenID Connect, and Google, Microsoft and GitHub sign-in, with roles and two-factor authentication.
- Network posture: no open inbound connections, because the architecture polls, with encrypted communication throughout.
- Data handling: tenant isolation, no training on customer data, and a local runner that scans on your machine and sends only encrypted results.
- AI choice: Zero AI mode with no language model in the loop, bring your own model, or Safeguard models inside your environment.
Download
Download the datasheet, US Letter (PDF)
Download the datasheet, A4 (PDF)
