What we never touch
Your sensitive data stays with you.
CMCGuardian checks settings, such as whether MFA is turned on. It never reads your mailboxes, documents or patient charts. It runs on commercial cloud services and is not meant for storing CUI, so please don't upload CUI or PHI to it.
Read-only connections
We can look, never change.
Every monitoring connection can only read settings, and alerts can only send. You approve each one, and you can cut it off at any time.
Microsoft 365 and GCC High
Read-only Microsoft Graph permissions that a Global Admin approves once (commercial or GCC High). Includes Intune device status and Defender alert counts.
To revoke: Remove CMCGuardian under Enterprise applications in Microsoft Entra.
Google Workspace
A Super Admin approves one read-only permission, “View users on your domain”. We never ask for Gmail, Drive or Calendar. The access token is encrypted with AES-256-GCM and locked to your organization.
To revoke: Remove CMCGuardian under Security → API controls in the Google Admin console. Disconnecting in CMCGuardian deletes and revokes the token.
Okta
A read-only API app with the Read-Only Administrator role. We sign in with our own key, so no shared secret is stored. We never ask for Super Administrator.
To revoke: Deactivate the CMCGuardian app in Okta.
Saviynt
A dedicated service account limited to running analytics. Its password is encrypted with AES-256-GCM and locked to your organization. We read only the number of findings, never the names.
To revoke: Disable the service account in Saviynt. Disconnecting in CMCGuardian deletes the stored password.
SailPoint
A Personal Access Token limited to three read scopes. Its secret is encrypted with AES-256-GCM and locked to your organization. We read only counts and due dates, never names.
To revoke: Revoke the token in SailPoint. Disconnecting in CMCGuardian deletes the stored secret.
NinjaOne
An API app with only the read-only Monitoring scope, limited to your one organization. Its secret is encrypted with AES-256-GCM and locked to your organization. We store counts only.
To revoke: Delete the API app in NinjaOne. Disconnecting in CMCGuardian deletes the stored secret.
AWS and GovCloud
An access key for a dedicated IAM user with only the AWS managed SecurityAudit policy, which reads settings and can't open S3 files or databases. We refuse root keys. The secret is encrypted with AES-256-GCM and locked to your organization.
To revoke: Delete the access key in AWS IAM. Disconnecting in CMCGuardian deletes the stored secret.
Slack, Teams and Jira alerts
Send-only. CMCGuardian posts the check name, control and summary when a check starts failing or is fixed, never user lists. It can't read your Slack, Teams or Jira. Webhook URLs and the Jira API token are encrypted with AES-256-GCM and locked to your organization, and only official Slack, Microsoft and Atlassian addresses are accepted.
To revoke: Delete the webhook or Workflow, or revoke the Jira API token. Removing it in CMCGuardian deletes the stored copy.
Live results never change your assessment answers on their own. You review every difference first.
Counts-only AI
Our AI sees numbers, not people.
CMCGuardian uses AI to explain check results in plain English. Before anything is sent, we strip it down to totals and settings.
What the AI receives
usersWithoutMfa: 3, adminsWithoutMfa: 1
What it never receives
jane.doe@company.com, john.smith@company.com
Your account
Sign-in protection that can't be phished.
Passkey sign-in
Sign in with your fingerprint, face, Windows Hello or a security key. Passkeys only work on cmcguardianapp.com, so they can't be phished. Your biometrics never leave your device; we only store a public key.
Protected passwords
Passwords are never stored. We keep only a bcrypt hash, and require at least 12 characters.
Safe password resets
Reset links work once, expire after one hour, and are stored only as a hash. We give the same reply whether or not an email is registered.
Role-based access
Only owners and admins of your organization can connect or disconnect systems. Each organization sees only its own data.
Encryption
- Everything travels over HTTPS, and browsers are told to always use it.
- Stored data is encrypted at rest by our database and storage providers.
- Connection secrets get an extra layer of AES-256-GCM encryption, with keys kept separately from the database.
What we keep
- Your questionnaire answers and the documents we generate (SSP, POA&M, Gap report)
- Daily check results and the evidence box, so you can show an assessor months of proof
- Where a fix needs it, the accounts behind a finding (for example, who is missing MFA), visible only to your organization
Service providers
The companies that help us run CMCGuardian.
We use established providers, each for one job.
Vercel
Application hosting
Neon
Database
Microsoft Azure
Evidence file storage
Anthropic
AI analysis (counts only)
Stripe
Payments (we never see card numbers)
Zoho
Account email, such as password resets
Found a security issue? Tell us.
If you believe you've found a vulnerability in CMCGuardian, please let us know through our contact form. We take every report seriously and will respond promptly.