Security at Threat Stack

Download the Threat Stack Security Overview

SOC 2

For the second year in a row, Threat Stack has completed a Type 2 SOC 2 examination for the Security and Availability Trust Services Principles for the intrusion detection platform and Oversight℠ service offerings. See our announcement here.

The SOC 2 report provides assurance to our customers and our own team that the organization has designed and implemented effective security controls as defined in the SOC 2 standards set forth by the American Institute of Certified Public Accountants (AICPA).

A copy of our SOC 2 report is available upon request. Please contact your sales representative or account team.

GDPR

Threat Stack is committed to data privacy and security, including complying with and, where applicable, helping our customers and users comply with the EU General Data Protection Regulation (GDPR). GDPR is the comprehensive EU-wide data privacy law that went into effect on May 25, 2018. Besides strengthening and standardizing user data privacy across the EU, it introduced new or additional obligations on all organizations that handle EU residents’ personal data, regardless of where the organizations are located.

Read the Full Threat Stack GDPR Overview

Security Features

Security, compliance, and privacy are first class citizens at Threat Stack, no more or less important than any of our other operating principles. Here are some popular features in the Threat Stack intrusion detection platform that our customers leverage to use the product more securely.

• Single Sign On (SSO) with SAML
  Tested against market-leading solutions, allows teams to bring their own access control policies and access auditing capabilities. See our support documentation for more information.
• Multi Factor Authentication (MFA, 2FA)
  For teams that do not want to bring their own SSO solution, our authentication system supports MFA natively. You may use your preferred mobile app to manage these codes.
• Secure Agent Repositories
  The Threat Stack Agent is one of the most critical pieces of our infrastructure because it’s installed software on customer systems. Once an Agent has successfully completed our rigorous security checks and SDLC for release, it is made available through standard Operating System package managers with verifiable keys. See our support documentation for more information.
• AWS Integrations are Read Only
  Whenever the Threat Stack intrusion detection platform integrates with your AWS account, the principle of least privilege is applied. We request read only access to only the services we need access to, nothing else. See our support documentation for more information.
• Data Portability via APIs & Webhooks
  Common use cases include e-Discovery and archival on top of our existing data retention. Additionally customers will use these features to enhance their SIEM, internal chat and email, and page dispatching tools with our data. It doesn’t matter the use case, we believe in data portability. See our support documentation for more information.
• Data Integrity via Insert Only Storage
  The technology behind the intrusion detection platform is designed to store critical Customer Data in an insert only manner, ensuring that we can preserve the integrity and availability of your data over time. Data collection via the Agent and AWS integrations has no notion of updating data. You don’t need to do anything extra to leverage this feature; it just happens.
• Analysis of Associated Activities
  The agent collects and transmits user, process, network, and file activities to the Threat Stack Cloud Security Platform^® where data is aggregated and analyzed. However, it does not collect any data from within those activities. For example, although we may see that a network connection was made, we will not see the data that was transmitted. Similarly, we may see that a file was touched, but not what was in the file.

Credit Card & Payment Information

Threat Stack never stores or receives credit card and payment information on its systems. We’ve partnered with a third-party, PCI-certified vendor for credit card processing.

Reporting Security Issues

At Threat Stack we take any reports of vulnerabilities seriously. If you encounter a security issue with any of our software or services, please report it to [email protected] We have an internal SLA for responding to such issues, and are committed to responding and fixing any issues promptly.

Please note that it is against our Terms of Service to run automated security scanning tools against our system without prior approval.

If you feel it is necessary due to the sensitivity of your message, PGP encrypt the contents of emails to [email protected] with the Key ID 523A9C07, which is available on the standard key servers. Doing so will likely delay our response as only certain team members are able to decrypt that key.