CUSTOMER SAFETY & TRUST CENTERVerified zero data retention

How CloudGuard protects your company data

Connecting Google Workspace or Google Cloud to a new tool requires confidence. We built CloudGuard with zero data retention for personal communications, encrypted credential custody, and strict read-only defaults. Below are our commitments to your team.

0 Email bodies stored

RFC 822 headers evaluated in RAM (<50ms) and discarded

0 Passwords recorded

Drills record input telemetry only; characters discarded

AES-256-GCM encryption

Authenticated ciphertext at rest with per-tenant derivation

Audit Manifest

Zero-Storage Invariants

VERIFIED

Keys Exposed

AES-256 Sealed

Message Text

Zero Body Store

Drill Passwords

Discarded in RAM

Read-Only

Default Mode

Fail-Closed IAM

View Safety Matrix Demo ↗

Customer Safety Matrix

Dedicated Page

Looking for our structured matrix of zero-storage commitments, data boundaries, and verification paths?

View safety matrix

Google Cloud credentialsEncrypted

Can CloudGuard expose our Google Cloud service account keys or OAuth tokens?

No. Keys and tokens are encrypted before storage. Your team and our app screens only see non-secret metadata, such as the service account email and connection status.

How we guarantee this

You connect Google once with admin approval. CloudGuard stores credentials as encrypted blobs, not readable text. Dashboards and exports never include private keys or refresh tokens.

Key safety guardrails

AES-256-GCM encryption at rest with a unique IV per credential
API responses omit secret fields by design
You can rotate or revoke the service account in Google Cloud at any time

Want to see the visual workflow?

Step through a 4-step explanation showing data boundaries, zero storage points, and your Google Admin controls.

Gmail and employee mailNot stored

Can CloudGuard store or leak employee email bodies, threads, or attachments?

No. CloudGuard scores messages in memory for phishing signals and keeps metadata only: sender, subject, message ID, time, and risk outcome.

Security awareness drillsNot stored

Can CloudGuard capture real passwords employees type during phishing simulations?

No. Drills record that input happened and how many characters were typed. The password string is discarded and never sent or stored.

Tenant and client isolationIsolated

Can another customer or an unassigned employee see our findings, projects, or integration secrets?

No. Every record is tied to your organization ID. Staff only see client workspaces they are assigned to; everyone else gets an access denied response with no data.

Google Cloud changesRead-only default

Can CloudGuard change or break our Google Cloud projects without approval?

No. New workspaces start in read-only audit mode. Destructive or mutating actions are blocked until an admin explicitly enables read/write remediation.

Jira and Notion scanningNot stored

If we connect Jira or Notion, can CloudGuard expose API keys found in tickets?

No. CloudGuard stores a one-way fingerprint of a matched secret and a link to the ticket. The raw key string is discarded immediately.

Dark web breach checksNot stored

Can breach lookups send our full employee email list to third-party vendors?

No. For supported providers CloudGuard sends only a truncated SHA-256 hash prefix of each normalized email, not the address itself.

Google sign-in and delegationYour control

Can signing into CloudGuard grant excessive Google Workspace or Cloud permissions?

No. Standard login asks only for openid, email, and profile. Workspace auditing uses separate domain-wide delegation that a super admin configures in Google Admin.

Test CloudGuard with 50 simulated enterprise identities

Verify our zero data retention, client warning isolation, and visual topology mindmap in our preloaded public demo environment. No signup or permissions required.

Launch interactive demo View safety matrix