How we protect your data
TLINK PRO helps you reduce your attack surface, so we hold our own platform to the same standard. Here’s what’s in place today.
Data protection
Your data is encrypted whenever it moves and wherever it’s stored.
- All traffic to TLINK PRO uses TLS, and HSTS tells browsers to only ever connect over HTTPS.
- The database volume is encrypted at rest.
- Backups are encrypted at rest with S3 server-side encryption (AES-256).
Access control
You decide who in your team can see and change what.
- Two-factor authentication (TOTP) with any authenticator app.
- Role-based access with four roles: Owner, Admin, Analyst and Viewer.
- An audit log of actions taken in your workspace.
- API keys scoped to the parts of the API they need.
- Single sign-on with SAML or OIDC (Okta, Microsoft Entra ID, Google Workspace and others), with an option to require it for your domains (Business and Enterprise).
- Admins can export the workspace’s data as CSV or JSON at any time. Connection secrets are never included.
Infrastructure & backups
TLINK PRO runs on Amazon Web Services in the us-east-2 region (Ohio, United States).
- Hosted on AWS in the US (us-east-2).
- Nightly backups, with encrypted copies kept off-site.
How we scan
Monitoring is light-touch and limited to what you ask us to watch.
- We only check assets you add to your workspace and are authorised to test.
- Checks are non-intrusive: DNS lookups, TLS handshakes, a check of common open ports and lookups against reputation and threat-intel sources.
- No agents to install and no exploit attempts.
Application security
The app itself is built to resist common attacks.
- Rate limiting across the API, with stricter limits on sign-in, sign-up and password reset.
- SSRF protection on outbound requests, so checks can’t be pointed at internal networks.
- A Content Security Policy that limits where scripts and other content can load from.
Responsible disclosure
If you think you’ve found a security issue in TLINK PRO, please email security@threatgrid.tech. Include a description of the issue, the steps to reproduce it and the impact you expect.
Please give us a reasonable chance to investigate and fix the issue before sharing it publicly. Don’t access, change or delete data that isn’t yours, and don’t run tests that degrade the service for others.
Related
Questions about security for your team? Talk to us.