This is a customer-focused details page describing the security in place for ZenGRC storage. As always, if you have additional questions feel free to reach out to support@zengrc.com
...
There are two approaches to this. First, you may grant external users access to your ZenGRC application (following your relevant access control procedures). Second, the Audit Dashboard provides a convenient way to download a zip file of evidence, which can then be provided to your external auditors (this feature is scheduled for delivery in v2.14).
How is my data protected in ZenGRC Storage?
...
Data is encrypted with Amazon managed keys:
Each object is encrypted with a unique key employing strong multi-factor encryption. As an additional safeguard, it encrypts the key itself with a master key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt your data
https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html
Encryption in Transit
Data is encrypted using TLS 1.2 when in transit between the ZenGRC application and ZenGRC Storage (AWS S3). Data is encrypted between the ZenGRC application and user based on the highest version of TLS supported by the user's browser. The minimum version of TLS supported by ZenGRC is v1.1.
...