Security

How we protect your data

Holistra holds some of your most sensitive information: where your weaknesses are. This page explains the controls that protect it, in plain terms.

Isolation

Your data stays in your organisation

On our cloud service, several organisations share the platform. Two independent layers keep each one's data separate.

Application scoping

Every read and write in the API is filtered to the signed-in user's organisation. Requests for another organisation's records get a plain "not found".

Row-level security

PostgreSQL row-level security enforces the same boundary inside the database. The application connects with a role that cannot bypass it, and our test suite runs under those rules on every change.

Single-tenant option

Prefer not to share infrastructure at all? Run a dedicated instance in your own data centre, with your data never leaving your network. See deployment options.

Agents

Agents that cannot be turned against you

An endpoint agent runs with administrator rights, so we designed it to accept work only from your server, and only work your server has signed.

Outbound only

Agents make outbound HTTPS requests and open no ports. The server cannot connect to them.

Approval gate

A newly enrolled agent receives nothing until an admin approves it. Revoked agents cannot authenticate.

Signed jobs

Every job is signed with Ed25519, bound to one agent and organisation, and expires after 24 hours. A job inserted or edited in the database is refused.

Signed releases

Agents update only to builds signed with our release key, which never lives on a server, and roll back on their own if an update fails.

Access

Sign-in your identity team will approve

Single sign-on with OpenID Connect: Microsoft Entra ID, Okta, Google, Keycloak and other standard providers, with group-to-role mapping.
SCIM 2.0 user provisioning, so leavers lose access when your directory says so.
Two-factor authentication (TOTP) with one-time recovery codes, and an organisation setting to require it.
Account lockout after repeated failed sign-ins, plus rate limits on sign-in endpoints.
Sessions in httpOnly cookies with short-lived access tokens; administrators can disable an account instantly.
Three roles (Admin, Security Engineer, Auditor), with Auditors strictly read-only.

Operations

How we run the platform

No self-signup. Organisations are provisioned by our staff, and our staff portal is not exposed to the internet.
Staff accounts are individual, with their own two-factor authentication and a record of what each person did.
Secrets such as identity-provider credentials and two-factor keys are encrypted in the database.
Production refuses to start without its signing keys and a strong administrator password; there are no default logins.
Threat-intelligence updates are signed, and your instance refuses any that are unsigned, altered or older than what it has.
A tamper-evident audit log records every change with the user and time: entries are hash-chained per organisation, the platform cannot edit or delete them, and one click verifies integrity.

Transparency

What we are still working on

We would rather tell you than have you find out in a review. SAML single sign-on, a least-privilege mode for agents, and code-signing of agent binaries for Windows SmartScreen and macOS Gatekeeper are on our roadmap. We have not yet completed an independent certification such as SOC 2 or ISO 27001.

Security questionnaire or architecture review? We will walk your team through the design in detail. Write to [email protected].

Found a vulnerability in Holistra? Please report it to the same address and we will respond promptly.

Talk to us about your security review

We will answer your questionnaire, show you the controls in a live environment, and help you plan a pilot.

Request a demo Explore the platform