Security at Galeo.

In transit

Every endpoint accepts TLS 1.3 only, using FIPS 140-3 cryptography, with post-quantum key exchange for browsers that support it.

At rest

All customer data is stored in AWS GovCloud (US) and encrypted at rest with AES-256. Integration secrets, such as client secrets and directory passwords, get a second layer of encryption.

Signing keys

Each organization has its own token signing keys and key IDs, published through standard JWKS discovery.

Sessions

Short-lived access tokens and server-validated refresh sessions that can be revoked at any time. Session cookies are out of reach of page scripts and protected against cross-site request forgery.

Factors

• WebAuthn / FIDO2 passkeys
• PIV / CAC smart cards and mTLS
• TOTP (RFC 6238)
• Kerberos (SPNEGO)
• Passwords with policy enforcement
• Email codes, and SMS codes on Platform Professional

Federation

• Any OpenID Connect identity provider, such as Okta, Ping, Keycloak, or Auth0
• Any SAML 2.0 identity provider, such as Okta or Ping
• Microsoft Entra ID and Google Workspace

Adaptive MFA

Each sign-in is scored on impossible travel, first-time country, unusual hour, and failed-login velocity. Above your threshold, Galeo asks for another factor; a sign-in that can't be verified is blocked.

Assurance level

Each token states the NIST authenticator assurance level of the sign-in: AAL1, AAL2, or AAL3. An app can require AAL2 or AAL3, and users who signed in with less are asked to sign in again.

Session protection

Can be set to reject and log a session that moves to a different browser or more than 100 miles from where it started.

Sign-in notice

Show your own system use notice on the sign-in page.

Account risk

On Identity Governance, mark an account compromised to end its sessions or place it on hold.

Password policy

Length requirements and breached-password screening, following NIST SP 800-63B. Complexity, history, and age rules are available if your policy needs them.

What's logged

Sign-in attempts, MFA challenges, step-up decisions, administrative actions, and configuration changes, with the actor, resource, IP address, and timestamp.

Integrity

The audit log has a single write path, and no API edits or deletes an entry. Expired months are removed only under the retention policy.

Retention

Kept for 30 days on Platform Essentials, 90 days on Platform Professional, and seven years on Identity Governance.

SIEM

On Identity Governance, security events stream in real time to Splunk HEC, a syslog collector as CEF over UDP, TCP, or TLS, Amazon SNS, an HTTPS webhook, or a Shared Signals receiver.

FedRAMP

Preparing for FedRAMP 20x (Class C). Continuous automated validation of our controls began September 2026.

SOC 2

Planned. Controls are designed to the SOC 2 Trust Services Criteria.

HIPAA

Aligned. Controls support HIPAA Security Rule requirements. BAAs are available for Enterprise customers.

GDPR

Aligned. Data Processing Agreements are available.

Email security@getgaleo.com. We acknowledge reports within two business days and keep you updated through the investigation. We don't pursue legal action against researchers acting in good faith.