Security
Threat Foundry is designed around controlled access, review-first automation, auditable workflows, secure deployment patterns, and a practical secure development lifecycle. This page summarizes the security practices built into the platform in a SOC 2-style format.
SOC 2-Style Overview
This overview is not a certification claim. It is a plain-language summary of platform controls and operating practices designed to support customer due diligence.
Threat Foundry development emphasizes small scoped changes, reviewable code paths, validation before deployment, and security-aware engineering practices.
The platform is designed to run in customer-controlled AWS environments with clear separation between application, database, network, and secret boundaries.
Access is governed through platform permissions and role-aware workflows so sensitive actions require explicit authorization.
Threat Foundry avoids hardcoded credentials, keeps secrets out of displayed configuration, and treats customer-generated detections and intelligence as private by default.
AI workflows are built with review gates and usage tracking so generated hunts, Sigma rules, YARA rules, summaries, and analysis remain accountable.
Threat Foundry records important operational actions so teams can review how intelligence became hunts, detections, triage items, and cases.
Potentially sensitive workflows are designed around explicit analyst approval, bounded queries, and read-only investigation patterns.
The deployment model supports health checks, repeatable container builds, database-backed state, and operational visibility for refresh and ingestion jobs.
Customer Review
Security Review
We can walk through architecture, deployment assumptions, data flows, access control, AI governance, and detection sharing controls with your security team.