One place to buy, deploy, and see your security

Hosting

The platform is built to run entirely in AWS GovCloud (US), on FedRAMP High authorized infrastructure, with private networks, a web application firewall, and controlled egress between the internet and your data. It is not yet in service. Direwolf itself is not FedRAMP certified or authorized. FedRAMP certification applies to the AWS infrastructure we build on, not to the Direwolf Platform.

Tenant isolation

Every record is tagged with its organization and separated at three layers: in the database, where row-level security, enforced for every query, keeps one organization’s data from being returned to another; in the application, which refuses to run a query without an organization in scope; and operationally, where sensor data is attributed through the endpoint-protection tenant created for your organization, never guessed from a hostname.

Identity and access

Multi-factor authentication is required for every user, with an authenticator app or a passkey. Passwords must be at least 12 characters and are checked against known-breached lists. Accounts lock after five failed attempts. New users join by invitation and set up MFA before they see any data; there are no temporary passwords.

Sessions

Sessions are held server-side, end after 15 minutes of inactivity and 12 hours in total, and sensitive actions such as downloading an installer require a fresh MFA check. Administrators can see active sessions and sign a user out everywhere.

AI SOC guardrails

AI triage is designed to run on Amazon Bedrock inside the same GovCloud boundary. Autonomous actions are limited by per-organization policies, rate limits, a list of hosts the AI may never isolate on its own, one-click undo, and a platform-wide switch that drops the AI to recommend-only. Every action is recorded with its reasoning.

Audit logging

Every login, administrative change, SOC decision, and autonomous action is written to an append-only audit log that the application can add to but not change or delete. Each record is chained to the previous one so tampering is detectable. Logs are kept online for at least one year; a longer-term write-once archive (currently intended to be three years) is planned.

Encryption

When the platform is in service, connections will use TLS 1.2 or later with a FIPS 140-validated security policy at the edge, and data at rest in databases, storage, queues, and secrets will be encrypted with customer-managed keys in AWS Key Management Service, whose hardware security modules are FIPS 140-validated. No secrets are stored in code.

Operations

Infrastructure is defined as code and changed only through reviewed pull requests. Container images and dependencies are scanned in CI before deployment.

This describes the platform as designed and built for launch. For the status of our compliance program, and for exactly what we do and do not claim, see the Compliance page.