How your data is handled
- Read-only. No configuration changes, no event injection, no attacks run. Nothing installed in your environment.
- Your token. Read-only, scoped by you to the items we read, revocable at any time. Requests come from one fixed address you can allowlist.
- Metadata only. Rule definitions, dependency inventories and telemetry metadata. Never raw events or log data.
- Deterministic verification. The engine uses no AI model to reach a verdict.
- Single-tenant. A workspace for each customer, in the United States, encrypted in transit and at rest with hardware-backed keys that cannot be exported.
- Deleted on request. At the end of the engagement, or within ten business days of a written request, confirmed in writing, with your encryption key retired. Only structural patterns in vendor vocabulary are kept.
- Evidence you can check. Every verdict carries evidence your engineers can check in their own SIEM.
Questions or a security review: security@dectyl.io