Security

Protecting the information you manage in Governy is a first-class concern. The platform is built around a simple principle: only the right people can see and change the right things, and your data stays under your control. This page gives a plain-language view of the safeguards in place — useful both for evaluating Governy and for reassuring your own stakeholders.

Least-privilege access

Every action in Governy is governed by role-based access control. Each person is given a role that grants exactly the access their job needs — and no more. The roles map to the real responsibilities in a compliance workflow:

Role	Intended for
Admin	Platform administrators with full access
Domain Manager	Workspace leads who manage their team and content
Analyst	Practitioners who carry out assessments and attach evidence
Approver	Reviewers who sign off on assessments
Auditee	Contributors who supply evidence for specific requirements
Reader	Stakeholders with read-only visibility

Roles are scoped to each workspace, so access always fits the context. The same person can hold different roles in different workspaces, and no one ever has broader access than their current assignment requires. Sensitive actions — approving assessments, managing users, removing records — are reserved for the roles explicitly entitled to them. Dividing responsibilities across these roles enforces segregation of duties — the person who carries out an assessment is never the one who approves it — a separation every major framework expects.

GIF PLACEHOLDER — Assigning a role

Insert a GIF here showing: an administrator assigning a role to a user within a workspace.

Strong authentication

Accounts are protected by several independent layers of modern authentication:

• Standards-based sign-in (OAuth 2.0) — access is based on the standard OAuth 2.0 authorisation protocol, with secure internal credential management and stateless sessions using JWT tokens.
• Invite-only access — people can only join through a tracked invitation; accounts cannot be self-registered, keeping the user base under administrator control.
• Verified identities — accounts are confirmed before they become active.
• Two-step verification — an optional second factor at sign-in adds protection, and high-risk account changes require an extra verification step.

Accountability

Key activity is recorded — who reviewed and approved each assessment, and the full version history of evidence and documents. The result is a clear, attributable trail that stands up to certification audits and internal review.

Your data, your infrastructure

Governy is self-hosted: it runs entirely within your own environment. Your audit data, evidence files and user information are stored and processed on infrastructure you control — giving your organisation full ownership over data residency and retention. Nothing leaves your environment unless you choose to export it.

Where your documents are kept

Evidence and policy files are the most sensitive material in any audit, so Governy gives you a deliberate choice over where they are stored. Two kinds of storage work out of the box:

• A file server (SFTP) — the built-in option, ideal for a server or network-attached storage (NAS) already running in your own data centre.
• Object storage (S3-compatible) — any system that speaks the widely used S3 standard, such as MinIO, Ceph, NetApp StorageGRID or Dell ECS, running inside your own network.

A clarification worth making

Choosing “S3” does not mean your documents travel to a public cloud. S3 is simply a common language that storage systems speak; pointed at a server inside your company, your files never leave your network. Going anywhere beyond your own walls is always an explicit choice — never the default.

Your data stays inside your company — by default

Because compliance evidence often contains personal data and sensitive findings, Governy is set up from the start to keep documents inside your organisation. Sending data to an outside location is a deliberate, visible decision an administrator has to make on purpose — it can never happen by accident. Any storage that sits outside your network is clearly marked with a red External badge on the settings screen, so there is never any doubt about where a given set of documents lives.

This is the posture that regulations such as GDPR, DORA and ISO 27001 expect when you handle sensitive material — and it is exactly how Governy behaves before anyone changes a single setting.

A separate home for each audit

Different audits can be pointed at different storage locations. One client’s evidence can live on one system while another’s lives somewhere else entirely — invaluable when a customer contract, a regulator or an internal policy requires certain data to be kept apart. Each workspace, and each audit within it, simply uses the organisation-wide default unless an administrator deliberately gives it a home of its own. Changing the choice only affects where new files are written, so existing documents are never moved or disrupted by the switch.

Encryption and protected credentials

• Documents encrypted at rest — when enabled, every file is encrypted by Governy before it is written to storage, and only decrypted when an authorised person reads it back. Even someone with direct access to the underlying storage would see nothing but unreadable data.
• Sealed access keys — the passwords and keys Governy uses to reach your storage are themselves strongly encrypted, so they are never left exposed in the database.
• A trusted connection — when using a file server, Governy verifies the server’s identity on every connection, protecting the link against impersonation.