Encryption
All traffic to the platform and API uses TLS 1.2 or higher. Customer data and evidence are encrypted at rest, with keys managed by our cloud provider's key management service.
Trust center
How we protect the platform and your data
ThreatWarder handles evidence about live attacks against our customers. This page describes the controls we run, the data we keep, and how to reach us about security.
Security program
Controls we operate
Access control
Single sign-on (SAML) and enforced multi-factor authentication for customer accounts. Role-based permissions inside each workspace. Staff access to customer data is limited, logged and reviewed.
Audit logging
Every action on a case, notice or setting is recorded with who, what and when. Logs are exportable to your SIEM.
Evidence integrity
Screenshots, page source and files are captured with timestamps and hashed at collection, so they can be relied on later.
Secure development
Code review on every change, dependency and container scanning in the pipeline, and regular penetration testing by an external firm.
Incident response
A documented incident process with defined severity levels. Customers affected by a security incident are notified without undue delay and, where required, within 72 hours.
Data handling
What we collect and how long we keep it
Monitoring data. To find abuse we collect publicly available content: web pages, domain registrations, certificate transparency records, social posts and app store listings that reference a customer's brand. This content may incidentally include personal data published by third parties. It is used only to detect and document abuse.
Case and evidence data. Confirmed threats are stored as cases with evidence packs. Evidence is retained for the life of the customer contract plus a period agreed in the contract, because it may be needed for legal proceedings.
Account data. Names, work email addresses and authentication records for the people who use the platform.
Deletion. On termination, customer data is deleted or returned within the period set out in the Data Processing Addendum, unless retention is required by law.
Location. The platform is hosted with a major cloud provider. Customers can choose EU or US hosting regions.
Compliance
Frameworks and documentation
Our controls are designed against the SOC 2 Trust Services Criteria and ISO/IEC 27001. Audit reports, penetration test summaries and our completed security questionnaires are available to customers and prospects under NDA. Ask your account contact or email [email protected].
Our Data Processing Addendum covers GDPR and UK GDPR requirements, including the list of subprocessors and the transfer mechanisms we rely on.
Responsible disclosure
Found a vulnerability?
We welcome reports from security researchers. Email [email protected] with enough detail to reproduce the issue. We acknowledge reports within two business days and keep you informed while we fix the problem.
If you act in good faith, avoid privacy violations, data destruction and service disruption, and give us reasonable time to remediate, we will not pursue legal action against you for your research.
Please do not test against customer accounts or data that is not your own, and do not run automated scanners against production systems without prior agreement.