Security & privacy
A security product must be secure itself.
Threeum Defense is designed around least privilege, deny-by-default authority, tenant isolation, and local-first privacy. This page describes those controls and the current limitations of the alpha.
Authority model
- Deterministic policy is authoritative. AI model output is advisory and cannot override policy or mint its own permissions.
- Deny-by-default. Privileged agent actions require a fresh, short-lived, signed capability lease tied to a specific action, resource, and budget.
- Bounded containment. Current containment acts only on a local registry (revocation) and a simulated sandbox adapter — no host firewall or process manipulation.
- No self-promotion. Adaptive changes pass regression gates and human review before they take effect.
Data protection
- Tenant isolation across data, threat graph, and keys.
- Least privilege with roles, key rotation, and revocation.
- Secrets stay out of logs and out of source control.
- Bounded inputs — normalized, size-limited events with structured errors.
- Audit trail of decisions, actions, and reversible registry mutations.
Privacy modes
Process locally; share only what's necessary
Local only
All processing stays on the device or in your environment. No raw data leaves.
Anonymized correlation
Share privacy-safe signals and derived metadata for cross-node correlation — not raw content.
Private cloud
Run in your own tenant with your keys and retention policy.
Air-gapped
Fully offline. Local protection continues without connectivity.
The Edge tier is designed to prefer derived metadata over raw content wherever that is sufficient.
The dashboard & your keys
The operational dashboard is an operator tool, not a consumer login. It holds your API key in memory only — never in localStorage, cookies, or the URL — and talks to a same-origin /v1 backend that you run.
- The public static copy of this site cannot reach your localhost; it detects that and shows deployment docs instead of transmitting a key.
- Before any authenticated call, it performs a
/healthcapability handshake to confirm it is talking to a Threeum Defense service. - Untrusted event strings are rendered as text, never as HTML — no injection from event content.
Current limitations
- All models are experimental research artifacts; published metrics are synthetic for six of the seven core families and public-dataset holdout for Edge and the TextGuard companion — not a guarantee of real-world efficacy. Swarm and Infrastructure exceed their false-positive budget at the frozen test threshold.
- No third-party security certifications are claimed.
- No production deployments or customers are claimed.
- Containment is local and simulated only in this alpha — no OS or network enforcement.
- Full production integrations, enterprise SSO, and high availability are in development.