Compliance
How long should you keep audit evidence? A decision guide
Retention for audit evidence depends on contracts, regulations and your own policy. How to decide a period, what to keep and when to delete safely.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
RFP questions about a vendor's own secure development practices
Ten questions that test how a security vendor builds and ships its own software, mapped to NIST SSDF practice groups and the CISA self-attestation form.
Oct 18, 20264 min read
Compliance
Apache 2.0 redistribution checklist: license, NOTICE and changes
Shipping Apache 2.0 code means including the license, keeping notices, marking your changes and carrying over any NOTICE file. A checklist for release day.
Oct 18, 20263 min read
Compliance
Can you combine Apache 2.0 and GPL code? It depends on the GPL version
Apache 2.0 is compatible with GPLv3 but not GPLv2, according to the GNU project. Why the patent terms cause it and how the or-later suffix changes the answer.
Oct 18, 20263 min read
Compliance
Answering 'do you train on our data' in security questionnaires
Buyers ask whether your AI product trains on their data. How to answer accurately when your answer depends on your own choices and your vendor's terms.
Oct 18, 20263 min read
Compliance
Answering breach notification questions: what you can promise
Buyers ask how fast you will tell them about an incident. What GDPR Article 33 says, what a processor can honestly commit to, and how to word the answer.
Oct 18, 20263 min read
Compliance
AI RMF current and target profiles: a gap analysis method
How to use AI RMF Current and Target Profiles for a gap analysis: score subcategories, set the target by risk, and turn gaps into a ranked roadmap.
Oct 18, 20263 min read
Compliance
AGPL network clause: what it requires if you run it as a service
If you modify AGPL software and users interact with it over a network, section 13 requires you to offer them your version of the source. How to check.
Oct 18, 20263 min read
Compliance
Access review evidence: what auditors look for in the record
A good access review record shows who reviewed what, when, the decision and that removals happened. A signed spreadsheet alone is often not enough.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.