Memory without evidence is liability.
Here is how we earn the trust of SOC/CTI buyers, CISOs, and GRC leads.
20 NIST 800-53 Rev 5 Moderate baseline families assessed. 36+ findings ranked and remediated. Traceability matrix complete. Phase 4 remediation in progress.
Honest about deferred items: Azure hosting is the primary cloud boundary, but ThreatRecall is not FedRAMP Authorized today. For CUI or federal workloads, use the self-hosted deployment inside your approved boundary until the Azure authorization package is complete.
Finding PT-2 (Meta Pixel on authentication pages) was closed 2026-05-29.
Authentication surfaces are first-party only — no Meta Pixel, no Google Fonts CDN,
no third-party analytics. Strict CSP enforced on all /auth/* paths.
CI gate #11 (scripts/check-auth-trackers.js) blocks re-introduction.
Automated enforcement before merge. Each gate blocks the build on failure. Agent-enforced pre-push checks; GitHub Actions workflow coverage expanding.
scripts/check-npm-audit.js — offline advisory check against pinned CVE table;
blocks on any unaccepted high/critical finding in production deps.
Supply chain audit last clean: 2026-06-03.
Accepted residual: inflight@1.0.6 (deprecated, no CVE, not in HTTP path —
pulled by bcrypt→node-pre-gyp→glob@7; tracked for removal).
npm run check:audit — offline CVE table check runs on every guard pass.
Direct deps pinned to known-safe versions; package.json overrides force
safe transitive versions for path-to-regexp, cookie, body-parser, qs, cross-spawn, and glob.
New high/critical advisories added to scripts/check-npm-audit.js before
merge — no silent accumulation of debt.
scripts/check-auth-trackers.js — asserts zero third-party tracker
or CDN script tags appear in /auth/* responses. FedRAMP PT-2 control.
Blocks deploy if any tracker pixel is detected on login or MFA pages.
scripts/check-status.js — verifies /status/api returns HTTP 200
with all required SLO fields (p95 read/write latency, uptime, incident list).
Catches missing SLO instrumentation before it reaches prod.
scripts/seed-pack-smoke.js — loads all CTI seed packs
(APT29/Volt Typhoon/HAFNIUM, Scattered Spider) into an ephemeral tenant,
asserts node counts, non-null TLP + seed_source on every row, and ≥1
evidence-backed recall result per pack. Blocks deploy if any seed pack
fails to load or produces malformed data.
Control enforced at two points: ingest time (classification on write) and query time (filter on read). The enforcement is structural — the recall pipeline sends only the analyst's plain-text query string to the LLM. Node content, evidence records, and incident data are returned directly from PostgreSQL and are never passed through the LLM.
nlToStructuredQuery) and embedding generation.
Nothing else.
kg_nodes must carry a tlp field (WHITE/GREEN/AMBER/RED).
Nodes without a TLP marking are staged and require explicit classification before commit.
Ingest batch audit trail stored in ingest_batches.
kg_nodes.tlp and excludes AMBER/RED nodes from result set before building the response.
The LLM never receives the full result set — only the query string for intent extraction.
OLLAMA_BASE_URL to your local endpoint. All LLM calls stay on your infrastructure.
Air-gapped mode disables LLM entirely (structured keyword search only).
All analyst interactions are written to the audit_logs table — write-once enforced by DB triggers
(UPDATE and DELETE are blocked). Every memory node carries source, confidence, TLP, timestamp,
and linked evidence IDs. Corrections and rejections are tracked with a full version history.
source, source_type,
tlp, confidence, ingested_at, and linked_evidence_ids.
Analysts can expand any result to see the full evidence chain in the Evidence Panel.
memory_corrections (reject/correct/merge).
Pre-change state is snapshotted in memory_versions with version_number and changed_by.
24-hour rollback window via /api/admin/rollback-correction/:id.
login_attempts table.
audit_logs.
sessions table for per-session revoke.
totp_secret stored encrypted. Can be required for analyst role or enforced org-wide.
Latency is measured per-route by middleware/perf.js — p50/p95/p99 sampled in 5-minute
in-memory buckets, persisted hourly to perf_samples.
Queries exceeding SDLC thresholds are logged to slow_queries with parameterized query text,
duration, route, and top-5 stack frames. Performance regressions are classified as bugs.
Full list as of 2026-05-29. Updated when sub-processors change.
| Sub-processor | Region | Purpose | Data category |
|---|---|---|---|
|
Azure App Service
azure.microsoft.com
|
East US 2 | Application hosting — Express web service | app traffic logs ATO not claimed |
|
Azure Database for PostgreSQL
azure.microsoft.com
|
East US 2 | Primary database — tenant data, KG, audit logs, incidents | CTI nodes evidence incidents audit logs user accounts |
|
Postmark
postmarkapp.com
|
US | Transactional email — onboarding drip, password reset, pilot confirmations | email addresses no CTI content |
|
OpenAI
openai.com
|
US | Query intent extraction and embedding generation on recall — query strings only | search query strings no node content no CUI |
|
Stripe
stripe.com
|
US | Subscription billing and payment processing | billing data no CTI content |
We won't tell you we have certifications we don't. Here's the current ground truth:
30-day Design Partner Pilot. No charge. You keep the data. Export everything on exit.