> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security & Privacy
> How Protect protects your data — encryption, isolation, certifications, residency
## Top-line guarantees
Every integration uses read-only API credentials. Protect itself is read-only. Actions can trigger outbound automations with your approval.
TLS 1.2+ in transit, AES-256 at rest. No exceptions.
ISO 27001 certified, Cyber Essentials, GDPR compliant.
## Data handling
### What data Protect stores
| Category | Examples |
| ---------------------------------- | -------------------------------------------------------------------------------------- |
| **Device metadata** | Hostname, serial, OS, last-seen times, integration data |
| **User metadata** | Email, department, job title, manager, Multi-Factor Authentication (MFA) state |
| **Integration credentials** | API keys, OAuth tokens, AD service-account creds — all encrypted in a per-tenant vault |
| **Saved views, Actions, Reports** | Your configurations |
| **Audit log** | Every meaningful platform action |
| **AI-generated app code (Studio)** | Yours — you can download it |
### What Protect does **not** store
* **Endpoint telemetry** — Protect doesn't collect logs, files, or process data from endpoints (no agents)
* **User passwords** — Protect uses Single Sign-On (SSO) or hashes
* **Personally Identifiable Information (PII) beyond what your Identity Provider (IdP) provides** — phone numbers, addresses are not collected by Protect itself
* **Internet history / DLP data** — only the metadata vendor APIs expose
### Where it's stored
| Concern | Default |
| -------------------------- | --------------------------------------------------------- |
| **Cloud provider** | AWS (multi-region) |
| **Primary data residency** | UK (London region) |
| **Other regions** | Available on request — contact your account manager |
| **Per-tenant isolation** | Logical isolation; encrypted-at-rest with per-tenant keys |
| **Backups** | Daily snapshots, encrypted, retained per tenant policy |
## Encryption
| State | Standard |
| ---------------------------- | -------------------------------------------------------------------------------------- |
| **In transit** | TLS 1.2+ for all API and UI traffic |
| **At rest (database)** | AES-256-GCM |
| **At rest (object storage)** | Server-side encryption with AWS KMS |
| **Integration credentials** | Per-tenant secret vault with KMS-managed keys; values never echoed in Composer or logs |
| **Audit log** | Same as primary database |
## Access controls within Protect
* **SSO** with Microsoft Entra ID (self-service), Okta (manual setup), generic Security Assertion Markup Language (SAML) / OpenID Connect (OIDC)
* **Four default [roles](/settings/roles)** plus unlimited custom roles
* **Data filters** per user (tag / location / device-class)
* **Field-level hiding** — sensitive fields can be hidden from specific roles
* **Audit log** of every meaningful action
See [Access Control](/access-control) for the full reference.
## AI access (Reporting)
When using [Reporting](/reporting), the AI Composer sees **schema only** — never your data values:
| The AI sees | The AI doesn't see |
| ---------------------------------- | --------------------------- |
| Field names (`deviceName: string`) | Actual device names |
| Field types | Actual user emails |
| Your prompts | Actual IP addresses |
| The code it's writing | Any raw integration payload |
Reporting apps run AI-generated code against your data on *your* side. The AI generates the program; Protect executes it.
You can further restrict what fields the AI sees in [Settings → Schemas](/settings/schemas).
## OAuth scope manifests
For Microsoft Entra ID, Microsoft 365 / Graph, Microsoft Defender ATP, and Google Workspace integrations, Protect uses standard OAuth 2.0 authorization-code flow. The OAuth URLs surfaced by the Reauthorise wizard at [Settings → Integrations](/settings/integrations) carry the request parameters below.
### Microsoft 365 (Graph)
| Parameter | Value |
| ------------------ | ---------------------------------------------------------------- |
| Authorize endpoint | `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` |
| Scope | `https://graph.microsoft.com/.default` |
| Redirect URI | `https://auth.threataware.com/api/auth/code-callback` |
| State key | `msgraph` |
The `.default` scope means the **actual Graph permissions** are configured on the ThreatAware Entra ID Enterprise Application — the Microsoft consent screen will list them. Required minimum permissions to fulfil the integration's documented features are read-only Graph claims (User, Directory, Device, Audit Log read scopes).
### Microsoft Entra ID / Microsoft Intune (shared app registration)
The Entra ID and Microsoft Intune integrations share a single Microsoft app registration. After clicking Reauthorise on either, Protect surfaces a confirmation prompt: *"A paired app '\' is already connected; would you like to use the same credentials to connect this app?"* — answering Yes reuses the existing tokens. Cancelling proceeds to the standard OAuth flow.
| Parameter | Value |
| ------------------ | ---------------------------------------------------------------- |
| Authorize endpoint | `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` |
| Scope | `https://graph.microsoft.com/.default` |
| Redirect URI | `https://auth.threataware.com/api/auth/code-callback` |
| State key | `devices_msgraph` |
### Microsoft Defender ATP
| Parameter | Value |
| ------------------ | ---------------------------------------------------------------- |
| Authorize endpoint | `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` |
| Scope | `https://api.securitycenter.microsoft.com/.default` |
| Redirect URI | `https://auth.threataware.com/api/auth/code-callback` |
| State key | `msdefenderatp` |
This uses the Microsoft Defender for Endpoint (`api.securitycenter.microsoft.com`) resource, not Graph.
### Google Workspace
Google requests explicit scopes (not `.default`):
| Parameter | Value |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authorize endpoint | `https://accounts.google.com/o/oauth2/auth` |
| Scopes | `https://www.googleapis.com/auth/admin.reports.audit.readonly`
`https://www.googleapis.com/auth/admin.reports.usage.readonly`
`https://www.googleapis.com/auth/admin.directory.user.readonly`
`https://www.googleapis.com/auth/admin.directory.customer.readonly` |
| Redirect URI | `https://auth.threataware.com/api/auth/code-callback` |
| `access_type` | `offline` (refresh token issued) |
| `prompt` | `consent` (forces consent screen every time) |
| `include_granted_scopes` | `true` |
All four Google scopes are **read-only**. Protect cannot mutate Workspace state.
### Non-OAuth integrations
Several integrations the security team often asks about do **not** use OAuth and therefore do not have a consent-screen scope manifest:
| Integration | Authentication |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Okta** | Read-Only Administrator API token. The wizard walks the operator through creating a dedicated user, granting Read Only Administrator, and generating an API token to paste into Protect. |
| **Crowdstrike** | API Client + Keys (Hosts / Assets read scopes), created in the Crowdstrike Console at Support > API Clients and Keys. |
| **Duo** | Admin API Application, created in the Duo Admin Panel. |
| **Jamf** | Read-only API account + Jamf Pro URL. |
### Common redirect URI
Every OAuth integration redirects to `https://auth.threataware.com/api/auth/code-callback` regardless of cloud region. Allowlist this hostname on egress controls if you proxy outbound HTTPS.
## Certifications
| Standard | Status | Scope |
| -------------------- | -------------- | -------------------------------------- |
| **ISO 27001** | Certified | Information security management system |
| **Cyber Essentials** | Certified (UK) | UK Government cyber baseline |
| **GDPR** | Compliant | Data protection by design |
Audit reports and SoA available under NDA — contact your account manager.
## Penetration testing
* Annual independent penetration testing of the platform
* Internal red-team exercises
* Bug bounty programme — disclosure via `security@threataware.com`
## Operational security
| Practice | Approach |
| ----------------------------------------- | ---------------------------------------------- |
| **Least privilege** for ThreatAware staff | Cell-based access, JIT elevation, MFA enforced |
| **Background-checked engineers** | All staff with production access |
| **Change control** | Peer review + CI checks on every change |
| **Incident response** | Documented runbooks; \<24h notification SLA |
| **Vendor risk management** | Annual review of subprocessors |
## Customer data deletion
On tenant termination:
1. Tenant data is marked for deletion immediately
2. Active database deletion within 30 days
3. Backup expiration within 90 days
4. Confirmation letter on request
## Contact
| Topic | Channel |
| ---------------------------- | -------------------------------------------------------------- |
| Security disclosure | [security@threataware.com](mailto:security@threataware.com) |
| Audit / certification | [help@threataware.com](mailto:help@threataware.com) → DPA team |
| Data subject access requests | [help@threataware.com](mailto:help@threataware.com) |
| Customer security questions | Your account manager |
## See also
Detailed platform architecture
Detailed compliance posture
User-facing security