Security & Privacy

​

Top-line guarantees

​

Data handling

​

What data Protect stores

​

What Protect does not store

• Endpoint telemetry — Protect doesn’t collect logs, files, or process data from endpoints (no agents)
• User passwords — Protect uses Single Sign-On (SSO) or hashes
• Personally Identifiable Information (PII) beyond what your Identity Provider (IdP) provides — phone numbers, addresses are not collected by Protect itself
• Internet history / DLP data — only the metadata vendor APIs expose

​

Where it’s stored

​

Encryption

​

Access controls within Protect

• SSO with Microsoft Entra ID (self-service), Okta (manual setup), generic Security Assertion Markup Language (SAML) / OpenID Connect (OIDC)
• Four default roles plus unlimited custom roles
• Data filters per user (tag / location / device-class)
• Field-level hiding — sensitive fields can be hidden from specific roles
• Audit log of every meaningful action

See Access Control for the full reference.

​

AI access (Reporting)

When using Reporting, the AI Composer sees schema only — never your data values: Reporting apps run AI-generated code against your data on your side. The AI generates the program; Protect executes it. You can further restrict what fields the AI sees in Settings → Schemas.

​

OAuth scope manifests

For Microsoft Entra ID, Microsoft 365 / Graph, Microsoft Defender ATP, and Google Workspace integrations, Protect uses standard OAuth 2.0 authorization-code flow. The OAuth URLs surfaced by the Reauthorise wizard at Settings → Integrations carry the request parameters below.

​

Microsoft 365 (Graph)

The .default scope means the actual Graph permissions are configured on the ThreatAware Entra ID Enterprise Application — the Microsoft consent screen will list them. Required minimum permissions to fulfil the integration’s documented features are read-only Graph claims (User, Directory, Device, Audit Log read scopes).

​

Microsoft Entra ID / Microsoft Intune (shared app registration)

The Entra ID and Microsoft Intune integrations share a single Microsoft app registration. After clicking Reauthorise on either, Protect surfaces a confirmation prompt: “A paired app ‘<other>’ is already connected; would you like to use the same credentials to connect this app?” — answering Yes reuses the existing tokens. Cancelling proceeds to the standard OAuth flow.

​

Microsoft Defender ATP

This uses the Microsoft Defender for Endpoint (api.securitycenter.microsoft.com) resource, not Graph.

​

Google Workspace

Google requests explicit scopes (not .default): All four Google scopes are read-only. Protect cannot mutate Workspace state.

​

Non-OAuth integrations

Several integrations the security team often asks about do not use OAuth and therefore do not have a consent-screen scope manifest:

​

Common redirect URI

Every OAuth integration redirects to https://auth.threataware.com/api/auth/code-callback regardless of cloud region. Allowlist this hostname on egress controls if you proxy outbound HTTPS.

​

Certifications

Audit reports and SoA available under NDA — contact your account manager.

​

Penetration testing

• Annual independent penetration testing of the platform
• Internal red-team exercises
• Bug bounty programme — disclosure via security@threataware.com

​

Operational security

​

Customer data deletion

On tenant termination:

1. Tenant data is marked for deletion immediately
2. Active database deletion within 30 days
3. Backup expiration within 90 days
4. Confirmation letter on request

​

Contact

​

See also