Skip to main content
Dimension runs on the same AWS-hosted ThreatAware platform stack you already use. This page covers the bits that matter for security review and architecture sign-off.
For an NDA-protected architecture deep dive — for example, as part of a vendor risk assessment — your account manager can connect you with the security team.

Where Dimension runs

  • Cloud provider — Amazon Web Services (AWS)
  • Hosting model — Multi-tenant SaaS, with per-tenant data isolation at the database and storage layer
  • Region — Your Dimension tenant lives in the same AWS region as your main ThreatAware tenant
  • Environments — Production, staging, and per-customer demo environments are physically separated

Tenant isolation

Every customer is a separate tenant. Isolation is enforced at three layers:

Network topology

  • Public ingress — only via your Dimension address (<your-tenant>.dimension.io) over TLS 1.2+, with every public endpoint protected by AWS WAF
  • Outbound calls from Data Feeds and Webhook Actions go through a per-request egress allowlist — destinations are recorded in Request History
  • Inter-service traffic stays inside our AWS VPC and goes via private endpoints; no traffic leaves the AWS region during normal operation

Encryption

Key management

  • Customer-facing secrets — auth credentials you paste into a Data Feed or Action (e.g. CrowdStrike Client ID/Secret) are stored in AWS Secrets Manager, encrypted with KMS, and never displayed in plain text after creation
  • Platform secrets — managed via AWS IAM + Secrets Manager rotation
  • Bring-your-own-key (BYOK) — available on the Enterprise plan; contact your account manager

Backup & disaster recovery

  • Automated daily backups of every tenant database
  • Point-in-time recovery (PITR) within the retention window
  • Cross-AZ replication in every supported region

Logging, monitoring, audit

  • Audit Log (Settings → Logs) records every platform-changing event
  • Request History records every outbound HTTP call from Data Feeds and Actions
  • Platform telemetry — request rates, error rates, latency — emitted to internal observability tooling; never contains customer data values
  • Infrastructure monitoring — AWS CloudTrail and CloudWatch provide audit logging and monitoring across the infrastructure, and AWS GuardDuty provides continuous threat detection across the AWS environment

Incident response

  • Detection — automated alerts on anomalous activity, plus a customer-facing security inbox (security@threataware.com)
  • Response — incident commander assigned within one business hour for severity-1 incidents
  • Customer notification — affected customers contacted within the timeline required by their contract or applicable law (GDPR, HIPAA, etc.)
  • Post-incident — public post-mortem for any incident affecting customer data confidentiality, integrity, or availability

Vulnerability management

Our infrastructure is monitored continuously as part of our secure development lifecycle (SDLC):
  • Code and containers — Aikido runs static code analysis (SAST), dependency scanning (SCA) and container image scanning. Vulnerabilities are flagged at commit and build time and stopped before they reach production.
  • Threat detection — AWS GuardDuty provides continuous threat detection across our AWS environment.
  • Penetration testing — regular independent penetration tests of the platform.
  • Reporting a vulnerability — email security@threataware.com.
The scanning covers the whole platform, including the runtime every Studio app runs on, so apps are covered continuously, not only when they’re published.

Security tooling

AI provider isolation

When Cross-origin models is enabled under Settings → AI, Composer can use Claude models from Anthropic that aren’t available in your region, under Anthropic’s published data-handling agreements. Requests to those models may be processed outside your region. Key facts:
  • Routing happens per-request, not per-tenant — there’s no persistent provider account holding your data
  • Schema-only mode (the default) keeps actual data values out of the prompt regardless of provider
  • Cross-origin models is a tenant-wide opt-in, Super Admin only, and audited in the Audit Log

High-level data flow

A typical Studio app request flow:
  1. User hits a Studio app via their browser
  2. Browser → CloudFront → ALB → Dimension gateway (TLS 1.2+ throughout)
  3. Gateway verifies the user’s JWT, extracts tenant scope, forwards to Dimension API
  4. Dimension API queries the tenant’s data via the row-level-scoped database
  5. App code runs server-side in a per-request sandbox; results returned to the browser
  6. Every step logged to the Audit Log + telemetry pipeline
No customer data leaves the AWS region during this flow. Outbound calls (Data Feeds, Webhook Actions) are explicit, recorded in Request History, and signed where applicable.

Architecture review

For a full architecture deep dive — diagrams, sub-processor list, BAA, DPA — email security@threataware.com or contact your account manager. NDA available on request.