ThreatRecall is built to FedRAMP Moderate. Every control, every gap, every sub-processor is documented here — because prospects evaluating us for CUI workloads deserve more than marketing language.
We are in Phase 4 remediation — working findings from Phase 3, targeting package completion in Q3 2026. Bi-weekly cadence with the assessment team. The traceability matrix, control evidence, and remediation plan are available in the public changelog with each gate.
We do not claim ATO or authorization. This page and all marketing materials will be updated the day authorization is granted. Until then, we will not tell you we have something we don't.
This is not a policy. This is a structural guarantee enforced at two points: ingest (classification on write) and
query (filter on read). The enforcement lives in the same SQL filter that ships in the /try public demo —
it is the same code, the same logic, in the same database query path.
/try/r/:slug permalinks.WHERE tlp IN ('WHITE','GREEN') clause in the recall query path. It ships identically in the public demo at /api/public/try/recall. The filter is applied server-side — it cannot be bypassed by a client-side request. Proof: /try cannot surface AMBER or RED content regardless of query intent.kg_nodes write requires a tlp field (WHITE/GREEN/AMBER/RED). Nodes without a marking are staged and require explicit classification before commit — automated triage is not allowed for unmarked content. ingest_batches tracks every batch's TLP distribution for audit.tenant_id. No cross-tenant visibility at the DB layer.OLLAMA_BASE_URL to your local endpoint. All LLM calls stay on your infrastructure. Air-gapped mode falls back to keyword search — no LLM dependency.
Audit logs cover analyst interactions, AI agent actions, and system events. Export in CSV or JSONL via
/docs/api#tag/Audit. Each export is signed with a UUID event_id
that cannot be modified post-export.
// Sample audit log row — synthetic, illustrative only { "event_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "timestamp": "2026-05-30T14:32:07.000Z", "user_id": "usr_4f8a9b2c1d3e", "action": "recall_query", "resource_type": "kg_nodes", "resource_id": "node_apt29_001", "workspace_id": "ws_demo", "tlp": "WHITE", "query_text": "APT29 lateral movement techniques", "result_count": 7, "user_agent": "Mozilla/5.0 ThreatRecall/1.0", "ip_hash": "sha256:3a4b5c...", "api_key_id": "key_hashed", "session_id": "sess_9f8e7d6c" }
audit_logs block UPDATE and DELETE. Export generates a deterministic checksum from the row contents so downstream consumers can detect tampering.sessions for per-session revoke.kg_nodes record carries source, source_type, tlp, confidence, ingested_at, and linked_evidence_ids. Corrections and rejections snapshotted in memory_versions with version_number and changed_by./api/admin/rollback-correction/:id within 24 hours of application. Pre-change state preserved in memory_versions.Updated 2026-05-29. Replaces any prior partial disclosure.
| Processor | Region | Purpose | Data Category |
|---|---|---|---|
Azure Database for PostgreSQL azure.microsoft.com |
East US 2 | Primary database — CTI nodes, evidence, incidents, audit logs, user accounts, sessions | CTI nodes evidence records audit logs user accounts |
Azure App Service azure.microsoft.com |
East US 2 | Application hosting — Express web service, session handling, API routing | app traffic request logs ATO not claimed |
Postmark postmarkapp.com |
US | Transactional email — onboarding drip, password reset, pilot confirmations, notification alerts | email addresses no CTI content |
OpenAI openai.com |
US | Query intent extraction and embedding generation on recall — query strings only, explicit scope | search query strings no node content no CUI no AMBER/RED |
Stripe stripe.com |
US | Subscription billing, payment processing, invoice management | billing data no CTI content |
Putting this in writing builds more trust than leaving it out.
30-day Design Partner Pilot. No charge. Export everything on exit.