Encryption in transit
availableTLS for all console and agent traffic; optional mTLS for device ingest.
Report integrity
availablePer-device Ed25519-signed, non-repudiable reports (Ed25519 + HMAC).
Device authentication
availablePer-device keys with rotation; available.
Role-based access (Org Admin / Analyst / Operator / Auditor), default-deny.
SAML 2.0 (signed-assertion validation) + OIDC, SCIM 2.0 provisioning.
Append-only audit trail of privileged actions, exportable.
Per-tenant data isolation across every record.
SaaS, on-prem, or fully air-gapped — no outbound egress in air-gap mode.