Security & Data
ThreatMap is a cyber security product — we hold ourselves to a higher standard. Here's exactly what we do, what we don't, and how we handle your data.
The bright line: what we touch and don't
| We do | We don't |
|---|---|
| Read public DNS, TLS, certificate data, WHOIS, service banners | Authenticate into your systems |
| Accept descriptors you push (asset IDs, SBOM, MFA status) | Ingest your raw logs (CloudTrail, VPC flow, SIEM events) |
| Connect to cloud accounts via read-only role you grant | Deploy agents on your endpoints |
| Call upstream providers (Shodan, VT, etc.) on your behalf | Capture packets on your network |
| Orchestrate partner tools via their public APIs | Read your data at rest |
If a capability requires entering your network, we partner with the vendor that does it and add our intelligence layer on top.
BYOK key security
When you register a provider API key (Shodan, VT, Censys, etc.), it's stored encrypted and never exposed:
- Encryption: AES-256-GCM with master key in KMS (AWS KMS on cloud; HashiCorp Vault on-prem).
- Never returned: No API endpoint returns your BYOK key — not even to you. UI shows last 4 characters only.
- Scoped: BYOK keys are scoped to your team/org — not visible to other teams or tenants.
- Audited: Every BYOK key usage is logged (provider, timestamp, calling user, success/failure).
- Lifecycle: Create, test, rotate, revoke — all via API or dashboard.
Data retention
| Data type | Retention | Storage |
|---|---|---|
| Identity (email, name) | Until account deletion + 30 days | RelataDB (encrypted) |
| API keys (hashed) | Until you revoke | RelataDB (SHA-256 hashed) |
| Credit transactions | 7 years (tax law) | RelataDB (immutable ledger) |
| Query data (IOCs queried) | 90 days (Teams) / 12 months (Enterprise) | RelataDB (ClickHouse door) |
| Agent audit log | 90 days (Teams) / 12 months (Enterprise) | RelataDB (ClickHouse door) |
| Historical intel (sightings) | 18 months (auto-TTL) | RelataDB (ClickHouse door) |
| Uploaded files (detonation, SBOM) | 30 days post-processing, then deleted | S3 / MinIO |
| Webhook delivery logs | 30 days | RelataDB |
What we do NOT store
- Full API response payloads in audit logs (only result summaries).
- Your internal network data (we never collect it).
- Source credentials in plaintext (always AES-256 encrypted).
- Payment card numbers (handled entirely by Stripe — we store last 4 only).
GDPR / CCPA rights
| Right | How |
|---|---|
| Access (Art. 15) | POST /v1/account/export — generates ZIP (JSON + CSV) within 24 hours |
| Deletion (Art. 17) | POST /v1/account/delete — identity anonymised, keys deleted, query data purged. Financial records retained 7 years (tax law), anonymised. |
| Portability (Art. 20) | Same export as access, in machine-readable JSON |
On RelataDB, deletion uses ERASE SUBJECT — a certified, auditable one-command erasure that removes all PII across all protocol doors.
Compliance roadmap
| Certification | Status | Target |
|---|---|---|
| SOC 2 Type II | In progress | Within 18 months of launch |
| ISO 27001 | Planned | Within 24 months |
| GDPR | Compliant by design | Live |
| HIPAA BAA | Available on Enterprise | On request |
| FedRAMP-ready | Planned | Target date on request |
| Annual pen test | Scheduled | Year 1 |
Vulnerability disclosure
security.txtatthreatmap.co/.well-known/security.txt- Report via security@threatmap.co (PGP key published)
- Response SLA: 48 hours acknowledgement, 7 days assessment, 90 days fix
- Bounty programme post-launch
Internal security
- Zero-trust internal access — no standing admin. Break-glass JIT elevation (2-person approval, 1-hour expiry, auto-logged).
- Secret scanning in CI — every commit scanned (TruffleHog). API keys or credentials = CI fails.
- Dependency monitoring — Dependabot/Snyk. Critical CVEs patched within 48 hours.
- TLS 1.3 minimum everywhere. HSTS preload on all domains.
- Encryption at rest — AES-256 on all databases and object storage.
Questions? Email security@threatmap.cofor our security questionnaire, SOC 2 progress, or pen test summary.