Data Portability and Provider Switching
TeamGRC is engineered to empower customer data sovereignty through comprehensive, self-service audit deliverables. At the conclusion of a customer agreement or during provider switching, the data that the customer can receive and export consists strictly and exclusively of the reports they create themselves from the platform's Audit section. It is entirely up to the customer to generate these reports and download them prior to account termination.
Scope of Exportable Audit Reports
The data eligible for export and portability is limited strictly to the compiled, auditor-ready PDF deliverables that customers generate on-demand within the platform's Audit section:
Custom Audit Evidence Packages
Assembled on-demand via Generate Custom Audit Report across 9 modular packages: Scope & Responsibilities, Risk & Posture, Regulations Matrix, Standards Matrix, NIST CSF - Core, NIST CSF - Target Profiles, ISO/IEC 27001, Policies & Controls, and Executive Oversight.
ISO 27001 Stage 1 Readiness Report
Generated via Generate ISO 27001 Stage 1 Report to verify implementation of core ISMS clauses, prerequisite checks, and organizational scoping for external certification body audits.
Audit Reports Registry & Meeting Minutes
Accessed and downloaded from Audit Reports, including historically compiled audit packages, regulatory matrices, and signed Clause 9.3 Management Review meeting minutes with SHA-256 cryptographic verification hashes.
Approved Policy Documents Export
Exported as immutable PDF documents via Policy Documents Export across all five GRC pillars (Governance, Data & Privacy, Engineering & Operations, Ecosystem & People, Resilience), including operative requirements and approval sign-offs.
How Customers Generate and Download Reports
Report generation and data extraction at TeamGRC is 100% self-service. Customers create and download each report directly through the native UI in the Audit section:
- Custom Audit Report Compilation: In the platform sidebar, navigate to Audit > Generate Custom Audit Report. Select individual packages or click "Choose All", verify prerequisite completion, and click Generate Selected Reports. The compilation engine automatically aggregates the data and generates corresponding PDF reports (taking approximately 10–30 seconds per report).
- ISO 27001 Stage 1 Report Generation: Navigate to Audit > Generate ISO 27001 Stage 1 Report. Verify that ISMS prerequisites are met, then click Generate Stage 1 Report to produce the comprehensive external auditor readiness package.
- Audit Registry & Meeting Minutes Downloads: Navigate to Audit > Audit reports. The registry provides immediate access to view and download previously compiled audit packages, regulatory matrices, and signed Clause 9.3 Management Review meeting records in PDF format.
- Approved Policy Documents Download: Navigate to Audit > Policy Documents Export. Download individual or bundled approved organizational policies as PDF documents for local archival or offline inspection.
- Customer Sole Responsibility: Generating and downloading these deliverables is strictly the customer’s responsibility. TeamGRC does not provide manual backend database extractions, raw API dumps, or engineering offboarding extraction services. Customers must ensure all required reports are generated and downloaded before their subscription access or post-termination export window expires.
Step-by-Step Provider Switching Protocol
To transition compliance records seamlessly from TeamGRC to another GRC platform or internal corporate archives, follow this customer-driven self-service workflow:
Report Formats, Technical Boundaries & Realistic Switching Expectations
- Standardized Document Deliverables: Exports are delivered as standardized, auditor-ready PDF documents. They encapsulate complete policy text, risk matrices, control mappings, and management review decisions. Migrating to another GRC tool entails ingesting these structured PDF deliverables; raw relational foreign keys and database schemas are not exported.
- Customer-Driven Pre-Termination Requirement: Because all audit reports are generated on-demand by the customer within the active application UI, reports cannot be compiled after tenant account closure. It is the customer's sole responsibility to generate and download all desired reports prior to the end of their subscription or export window.
- Tenant Settings & Access ACLs: Internal platform user profiles, role definitions, MFA tokens, session logs, and tenant UI preferences are specific to the TeamGRC SaaS platform and are non-transferable.
Distinction: Customer Deliverables vs. TeamGRC Proprietary Platform
In accordance with Sections 10 and 11 of the Master Services Agreement, the legal and operational boundaries between customer deliverables and vendor intellectual property are defined as follows:
| Data Category | Included Items | Legal Ownership & Portability |
|---|---|---|
| Customer-Owned Reports & Deliverables | All audit evidence packages, ISO 27001 Stage 1 readiness reports, approved policy documents, risk registers, and signed management review minutes generated and downloaded by the customer from the Audit section. | Exclusively Owned by Customer Full export rights at no cost; perpetual right to use, modify, archive, and present to external auditors and regulators. |
| TeamGRC Proprietary Platform & Engine | Platform source code, report compilation engine, AWS serverless architectures, AgentCore / Bedrock AI prompts and orchestration workflows, proprietary risk scoring ontologies, baseline benchmark questionnaire definitions, and UI workflows. | Retained Exclusively by TeamGRC Proprietary vendor intellectual property; not subject to customer export or third-party licensing. |
Maintainable Audit Reports Register
The register below catalogs the verified customer-exportable deliverables created and downloaded through the Audit section, their file formats, application navigation source, preserved fields, and integrity standards:
| Report Deliverable | Export Format | Audit Section Source | Preserved Fields & Relationships | Standards & Integrity |
|---|---|---|---|---|
| Custom Audit Evidence Packages | PDF (PDF/A) | Audit > Generate Custom Audit Report |
9 selectable modular packages: Scope & Responsibilities, Risk & Posture, Regulations Matrix, Standards Matrix, NIST CSF (Core & Target Profiles), ISO/IEC 27001, Policies & Controls, and Executive Oversight. Assembles scope boundaries, threat likelihood/impact ratings, regulatory cross-walks, and control mappings. | ISO 19005 (PDF/A), FIPS 180-4 (SHA-256) |
| ISO 27001 Stage 1 Readiness Report | PDF (PDF/A) | Audit > Generate ISO 27001 Stage 1 Report |
ISMS implementation evidence across mandatory Clauses 4–10, prerequisite verification checklists, Statement of Applicability status, and formal auditor readiness declarations. | ISO/IEC 27001:2022 Stage 1 Criteria, PDF/A |
| Audit Reports Registry & Meeting Minutes | PDF (PDF/A) | Audit > Audit reports |
Historically compiled audit evidence packages, regulatory matrix snapshots, and signed Clause 9.3 Management Review meeting minutes including attendee records, strategic decisions, and embedded document verification hashes. | ISO 27001 Clause 9.3, FIPS 180-4 (SHA-256 Checksums) |
| Approved Corporate Policy Documents | PDF (PDF/A) | Audit > Policy Documents Export |
Versioned operational policies across all five GRC pillars (Governance, Data & Privacy, Engineering & Operations, Ecosystem & People, Resilience), operative requirements, control links, and approval sign-off metadata. | ISO 19005 (PDF/A) |
Audit Section Report Package Specifications
The platform's Audit section compiles your organization’s operational and compliance data into four standardized, immutable report categories. These report packages provide comprehensive, auditor-ready documentation for provider switching, external certification, and regulatory inspection:
Infrastructure Location, Jurisdiction & Governmental Access Safeguards
TeamGRC hosts customer data exclusively in certified German data centers. This section sets out the verified hosting configuration, legal jurisdiction, foreign legal exposure analysis, and comprehensive safeguards against unlawful third-country governmental access to non-personal and personal data.
Confirmed Infrastructure Hosting Location
The infrastructure scope encompasses:
- Primary Hosting: High-availability AWS data centers located in Frankfurt am Main, Hesse, Germany, featuring biometric perimeter security, 24/7 armed surveillance, redundant power, and third-party certifications including ISO/IEC 27001, ISO 27017, ISO 27018, and SOC 2 Type II.
- Data Redundancy & Backups: Database tables and storage buckets are synchronously replicated across three distinct Availability Zones within Frankfurt region. Automated weekly backups are maintained on a strict 90-day encrypted rotation cycle (MSA Section 19.2). No cross-region disaster recovery replication outside Germany is configured.
- System Logging: Centralized AWS CloudTrail and Amazon CloudWatch log groups reside strictly in Frankfurt region, monitoring application activity with automated 24/7 alerting.
- Support & Ticketing Access: All customer support tickets and uploaded case attachments are stored directly within isolated DB and objects storage partitions in Frankfurt. TeamGRC does not utilize third-party external ticketing vendors. Support triage is conducted strictly in-house by authorized personnel bound by written non-disclosure agreements.
Legal Jurisdiction & Foreign Law Exposure Analysis
Understanding infrastructure sovereignty requires distinguishing between physical data center locations, contractual governing law, and parent-company corporate structures:
TeamGRC Contractual Jurisdiction
TeamGRC Inc. operates European headquarters in Amstelveen, The Netherlands. Under MSA Section 20.1, the customer agreement is governed by the laws of The Netherlands, with exclusive jurisdiction resting in the District Court of Amsterdam (Rechtbank Amsterdam).
Cloud Infrastructure Provider
Cloud computing services are contracted through Amazon Web Services EMEA SARL (headquartered in Luxembourg), operating facilities through Amazon Data Services Germany GmbH in Frankfurt, subject to German and European Union law.
Verified Technical Security Measures
To protect customer data and reduce the risk of interception, unauthorized access, disclosure, or alteration, TeamGRC applies the following technical security controls:
AES-256 Encryption at Rest
All customer records in DB tables, persistent objects storage, and automated snapshots are encrypted at rest using AES-256 via AWS Key Management Service (AWS KMS).
TLS 1.2 Encryption in Transit
All data moving across public networks is encrypted using TLS 1.2 (or higher) with modern cipher suites and Perfect Forward Secrecy (PFS), preventing eavesdropping or retro-decryption.
Tenant Logical Partitioning
Strict database partition key segregation (CompanyID / tenant) isolates customer data across DB and objects storage partitions. No shared, cross-tenant database rows or open buckets exist.
Access Control & Least Privilege
Internal access enforces strict role-based access control (RBAC) and mandatory multi-factor authentication (MFA). Across AWS cloud resources, granular, restrictive policies isolate each compute component on a strict least-privilege basis.
Cryptographic Integrity Hashing
Generated audit binders and compliance packages have SHA-256 integrity hashes computed upon creation, ensuring evidence immutability and instant detection of tampering.
Centralized Audit Logging
Centralized AWS CloudTrail and Amazon CloudWatch log groups record all administrative access, API calls, and system modifications, with automated anomaly alerting enabled 24/7.
Organisational & Contractual Safeguards Against Governmental Access
In accordance with the standards established by Article 28 of the EU Data Act for non-personal data held in the European Union, TeamGRC has contractually committed to and operationally established the following legal evaluation procedures:
Subprocessor Contractual Safeguards (AWS Commitments)
TeamGRC maintains a direct contractual relationship with Amazon Web Services under the AWS Customer Agreement and the AWS EU Data Protection Addendum. Key subprocessor commitments established by AWS include:
- Challenging Unlawful Requests: AWS formally commits to challenging any government request for data that is unlawful, overbroad, or in conflict with EU law.
- Notice to Customers: AWS policy requires notifying the service provider before disclosing content data, unless prohibited by a court order.
- Zero Direct Backdoors: AWS does not provide any government with direct, unfettered access or "backdoor" access to customer content stored in AWS data centers.
For further details on AWS infrastructure commitments, consult the official documentation:
Relationship to Personal Data & Data Processing Addendum
While Article 28 of the EU Data Act governs international access to non-personal data, the processing of personal data (such as user account credentials, email addresses, and auditor names) is independently and strictly governed by TeamGRC’s Data Processing Addendum (DPA) (Exhibit D of the Master Services Agreement) pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR). Where applicable, transfers are reinforced by European Commission Standard Contractual Clauses (SCCs Module 2: Controller-to-Processor).
Transparency & Portability Enquiries
For all enquiries, including technical support, audit report generation, data exports, provider switching, hosting transparency, privacy, and legal matters, contact TeamGRC Support.