Skip to content
Context GRC

Resources

Materials for your review

Sample artifacts use invented data only. Nothing here comes from a utility's records.

  • Capabilities Guide

    How Context GRC works across the drift engines, evidence, risk, and the audit portal.

    Open in new tab

  • Executive Brief

    A two-page overview for compliance leaders.

    Open in new tab

  • Software Bill of Materials

    Available on request. Every release ships with an updated SBOM.

    Request by email

  • GoEvolve Cybersecurity Program and SIG Lite response

    Shared under NDA.

    Request by email

Trust & Security

Built to be inspected

Designed to support your programs. It does not confer certification.

  • Air-gap ready

    Containerized on-prem or private cloud. Every front-end library is vendored locally with documented licenses and SHA-256 manifests, so there are no runtime CDNs.

  • Credentials & MFA

    PBKDF2-HMAC-SHA256 at 600,000 iterations, a NIST SP 800-63B passphrase policy, and TOTP multi-factor authentication.

  • Secrets

    Integration credentials are Fernet-encrypted with a rotation script. Secrets are injected through Docker secrets.

  • Transport & ledger

    TLS between services and a hash-chained, tamper-evident audit ledger of recorded actions.

  • Worker isolation

    Ed25519-signed task envelopes, a least-privilege worker database role under row-level security, pre-persistence DLP screening, and fenced untrusted document text in prompts.

  • Access control

    Role-based access with per-context role grants, and context-scoped views and roles.

  • Supply chain

    177 exact-pinned packages with about 3,000 SHA-256 hashes. CI gates: Bandit, TruffleHog, pip-audit --strict, a copyleft license gate, and Trivy.

  • Attributable approvals

    AI-proposed controls, mappings, and actions are staged for a named, authenticated reviewer to approve across four triage touchpoints, with the decision recorded. Cmd+K opens the command palette.

Licensing

  • Licenses are Ed25519-signed tokens verified locally, with no phone-home.
  • Tiers are set by the number of contexts and internal users.
  • Free Auditor: auditor accounts never consume a seat.
  • After a 14-day grace period the platform moves to a read-only archive. It never locks you out of your records.