Workspace membership enforcement
Server-side app operations recheck account, workspace and membership context before returning tenant-scoped data.
Security
Boundaries that preserve scope and evidence.
Security starts with explicit tenant, target, operation and evidence boundaries. This page lists controls implemented in the current product—not future certification claims.
Implemented controls
Defense across the investigation lifecycle.
Each control is enforced by app or engine code and supports a specific customer boundary.
Workspace-scoped API keys
Keys are workspace-owned service principals with explicit scopes, limits, revocation and responsible-use version checks.
Private app-to-engine boundary
Browser code calls app-owned routes. Private FastAPI operations require a service token and signed operation context.
Signed operation context
Backend operations validate tenant, actor, scope, capability and immutable plan claims instead of trusting browser fields.
Target safety
Central classification blocks protected, internal, reserved or otherwise unsafe network targets before bounded network work.
Immutable evidence references
Collected artifacts retain hashes, provenance, media type, size and explicit truncation or omission reasons.
Sanitized customer output
Public and customer-facing output excludes source-service credentials, service tokens, operation claims, DB identifiers and private engine links.
Audited raw-evidence reveal
Tenant scope, permission, sanitization and a recorded reason govern supported raw-evidence access.
Deterministic plan binding
Preview and create share a persisted plan and fingerprint; runtime dispatch remains registry and policy bound.
Idempotency and credit reservation
Stable operation keys and durable reservations protect retries from duplicate execution or account debit.
Tigess does not claim SOC 2, ISO 27001, SSO, SCIM, a contractual SLA, private deployment, or production backup, deletion and incident-response guarantees on this public page.
Security reporting
Report sensitive details through an agreed channel.
If you believe you found a security issue, request a safe reporting channel. Do not place exploit details, credentials, keys, targets or raw evidence in the public form.
Include in the first message
- General affected surface, without sensitive reproduction data
- Whether the issue may be actively exploited
- A safe way to coordinate follow-up
- No customer data, secrets or active testing against third parties
Start with a target
Investigate public evidence without weakening tenant boundaries.
Create an account to plan your first evidence-backed investigation, or talk to us about team and workflow requirements.