Buyer FAQ
Questions a compliance officer should ask
Straight answers about who builds Context GRC, what it costs, what it runs on, and what it cannot do yet.
Buyer FAQ
Straight answers about who builds Context GRC, what it costs, what it runs on, and what it cannot do yet.
Trust & Security
Designed to support your programs. It does not confer certification.
Containerized on-prem or private cloud. Every front-end library is vendored locally with documented licenses and SHA-256 manifests, so there are no runtime CDNs.
PBKDF2-HMAC-SHA256 at 600,000 iterations, a NIST SP 800-63B passphrase policy, and TOTP multi-factor authentication.
Integration credentials are Fernet-encrypted with a rotation script. Secrets are injected through Docker secrets.
TLS between services and a hash-chained, tamper-evident audit ledger of recorded actions.
Ed25519-signed task envelopes, a least-privilege worker database role under row-level security, pre-persistence DLP screening, and fenced untrusted document text in prompts.
Role-based access with per-context role grants, and context-scoped views and roles.
177 exact-pinned packages with about 3,000 SHA-256 hashes. CI gates: Bandit, TruffleHog, pip-audit --strict, a copyleft license gate, and Trivy.
AI-proposed controls, mappings, and actions are staged for a named, authenticated reviewer to approve across four triage touchpoints, with the decision recorded. Cmd+K opens the command palette.