> ## Documentation Index
> Fetch the complete documentation index at: https://docs.triform.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> How Triform protects your data and systems

## Our commitment to security

Security is fundamental to Triform. We implement industry-standard practices to protect your Projects, data, and credentials.

## Data encryption

### At rest

All data stored in Triform is encrypted using **AES-256** encryption.

**Encrypted data includes:**

* Project code and configurations
* Execution logs and traces
* Project Variables
* API keys
* User information
* **OAuth credentials and tokens** — Securely encrypted using Scaleway KMS

**Key management:** Encryption keys are managed using industry-standard key management services (Scaleway KMS), rotated regularly, and never stored alongside encrypted data.

### OAuth credential encryption

**Scaleway KMS Integration:**

* Dedicated key management service for OAuth tokens
* End-to-end encryption for third-party credentials
* Automatic key rotation support
* Secure encryption/decryption for token refresh
* Organization-specific encryption keys created on signup

### In transit

All communication with Triform uses **TLS 1.2+** encryption.

**Encrypted connections:**

* Web interface (HTTPS)
* API requests (HTTPS)
* Webhook callbacks (HTTPS)
* Database connections (encrypted)
* Internal service communication (mutual TLS)

**Certificate management:** We use trusted Certificate Authorities and monitor certificate expiration.

## Authentication

### Supported methods

**OAuth 2.0 providers:**

* Discord
* GitHub
* Google
* Microsoft

**Email:** Passwordless email authentication

**Benefits:**

* No password management burden
* Leverage provider security (2FA, etc.)
* Single sign-on capabilities
* Secure token refresh mechanisms

### Session management

**Security features:**

* Sessions expire after inactivity
* IP address validation (optional)
* Device fingerprinting
* Concurrent session limits

**User controls:**

* View active sessions
* Revoke individual sessions
* Revoke all sessions (sign out everywhere)

### Two-factor authentication (2FA)

**Strongly recommended for:**

* Organization Admins
* Users with deployment permissions
* Users handling sensitive Projects

**Supported methods:**

* Authenticator apps (TOTP)
* SMS (where available)
* Backup codes

**Enforcement:** Organization Admins can require 2FA for all members.

## Authorization

### Role-based access control (RBAC)

**Organization roles:**

* **Admin** — Full access
* **Editor** — Create, edit, execute
* **Viewer** — Read-only

**Project-level permissions:**

* Fine-grained per-Project overrides
* Specific user grants
* Temporary access grants

### API key security

**Best practices enforced:**

* Keys are hashed in storage (irreversible)
* Keys shown only once upon creation
* Keys can be scoped to specific Projects
* Keys can be restricted by permissions
* Keys can expire automatically
* Key usage is logged

**User responsibilities:**

* Store keys securely (environment variables, secret managers)
* Rotate keys regularly (90-day recommendation)
* Revoke unused keys
* Never commit to version control

### OAuth token security

**Enterprise-grade OAuth 2.0 implementation:**

* **Secure credential storage** — All OAuth tokens encrypted with Scaleway KMS
* **Automatic token refresh** — Transparent refresh of expired tokens
* **Scope-based permissions** — Fine-grained control over API access
* **Multi-provider support** — Google, Microsoft, GitHub, GitLab, Slack, Linear, Notion, and more
* **Memcache layer** — High-performance caching with TTL management
* **Provider-agnostic architecture** — Consistent security across all OAuth providers

**Token lifecycle management:**

* Tokens encrypted at rest using KMS
* Secure token injection during action execution
* Automatic refresh before expiration
* Proper cleanup on revocation
* Real-time token status via WebSocket

## Network security

### API security

**Protection mechanisms:**

* Rate limiting (prevents abuse)
* DDoS mitigation
* Input validation and sanitization

**Monitoring:**

* Anomaly detection
* Suspicious activity alerts
* Failed authentication tracking

### Webhook security

**Verification options:**

* API key authentication

**Replay attack prevention:**

* Timestamp validation
* Nonce tracking
* Request idempotency

## Code execution security

### Sandboxed execution

Actions run in isolated environments:

**Isolation features:**

* Separate containers per execution
* No persistent file system
* Limited network access
* Resource quotas (CPU, memory, time)
* No access to Triform internals

**What Actions CANNOT do:**

* Access other users' data
* Modify Triform infrastructure
* Persist data between executions (unless using provided storage)
* Execute arbitrary system commands
* Fork processes or spawn daemons

### Dependency security

**Automated scanning:**

* Check for known vulnerabilities in dependencies
* Alert on critical CVEs
* Suggest updates for vulnerable packages

**User responsibilities:**

* Keep dependencies updated
* Review security advisories
* Avoid deprecated packages
* Audit third-party packages

### Code review

**Recommended for sensitive Projects:**

* Peer review before deployment
* Automated security scanning
* Manual audit of high-risk components

## Vulnerability management

### Responsible disclosure

Found a security issue? We appreciate responsible disclosure.

**Reporting:**

* Email: [security@triform.ai](mailto:security@triform.ai)
* Include detailed description
* Steps to reproduce (if applicable)
* Potential impact assessment

**Our commitment:**

* Acknowledge within 24 hours
* Triage and investigate promptly
* Keep you informed of progress
* Credit you in our security updates (unless anonymous)

**Please don't:**

* Publicly disclose before we've patched
* Exploit the vulnerability
* Access other users' data

### Security updates

**Communication:**

* Critical issues: Email all users immediately
* High severity: Status page + email within 24 hours
* Medium/low: Included in regular updates

**Patching:**

* Critical vulnerabilities: Emergency patch within hours
* High severity: Patch within 7 days
* Medium/low: Patch in next regular release

## Infrastructure monitoring

### Enhanced observability

Recent infrastructure improvements provide better security monitoring:

* **Kubernetes Promtail** — Comprehensive log aggregation with label extraction and pipeline processing
* **Secure credential management** — 1Password integration for automated, secure environment variable handling
* **Better deployment security** — Automated dependency checks and secure secrets management

These improvements enhance our ability to detect, investigate, and respond to security events in real-time.

## Incident response

### Detection

**Monitoring systems:**

* Failed authentication attempts
* Unusual API usage patterns
* Data exfiltration attempts
* Privilege escalation attempts
* **Real-time log aggregation** — Kubernetes-based monitoring for immediate anomaly detection

**Alerts trigger:** Automated response + human investigation

### Response process

1. **Detect & triage** — Identify and assess severity
2. **Contain** — Limit impact, isolate affected systems
3. **Investigate** — Determine root cause and scope
4. **Remediate** — Fix vulnerability, restore service
5. **Communicate** — Inform affected users
6. **Learn** — Post-mortem, improve processes

### User notification

**We notify if:**

* Data breach occurs
* Unauthorized access detected
* Service compromise affects your Projects

**Notification includes:**

* What happened
* What data was affected
* What we've done
* What you should do

## User security responsibilities

### Account security

> **Use strong passwords** — If using email authentication

> **Monitor sessions** — Review and revoke suspicious sessions

> **Keep email secure** — Your account recovery method

### API key security

> **Never commit keys to git** — Use environment variables

> **Rotate keys regularly** — Every 90 days recommended

> **Scope keys minimally** — Only grant needed permissions

> **Revoke unused keys** — Reduce attack surface

### Code security

> **Validate inputs** — Don't trust external data

> **Sanitize outputs** — Prevent injection attacks

> **Review dependencies** — Check for vulnerabilities

> **Keep secrets in Project Variables** — Never hardcode

### Organization security

> **Audit members regularly** — Remove ex-employees

> **Follow least privilege** — Grant minimum necessary permissions

## Security features roadmap

**Coming soon:**

* SSO/SAML support (Enterprise)
* Advanced threat detection
* Custom security policies
* Bring Your Own Key (BYOK) encryption
* Enhanced audit logging
* Security compliance dashboards

## Security resources

### Contact

**Security issues:** [security@triform.ai](mailto:security@triform.ai)\
**General support:** Join our [Discord community](https://discord.gg/triform)

### External resources

* [OWASP Top 10](https://owasp.org/Top10/)
* [Cloud Security Alliance](https://cloudsecurityalliance.org/)
* [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)

## Questions?

If you have security questions or concerns:

1. Review the security documentation
2. Contact [security@triform.ai](mailto:security@triform.ai)
3. For Enterprise, contact your account manager