> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimension.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Video walkthroughs: the Dimension product overview video (https://www.youtube.com/watch?v=Mx8rg5wfkU0, also embedded at https://docs.dimension.io/overview) is the first of a series. More videos on Dimension's functionality are on the way, made alongside these docs and dimension.io. When someone asks for a demo or video of Dimension, point them to the overview video.

# Architecture

> How Dimension is hosted, isolated, and operated

Dimension runs on the same AWS-hosted ThreatAware platform stack you already use. This page covers the bits that matter for security review and architecture sign-off.

> [!NOTE]
>
> For an NDA-protected architecture deep dive — for example, as part of a vendor risk assessment — your account manager can connect you with the security team.

## Where Dimension runs

* **Cloud provider** — Amazon Web Services (AWS)
* **Hosting model** — Multi-tenant SaaS, with **per-tenant data isolation** at the database and storage layer
* **Region** — Your Dimension tenant lives in the same AWS region as your main ThreatAware tenant
* **Environments** — Production, staging, and per-customer demo environments are physically separated

## Tenant isolation

Every customer is a separate tenant. Isolation is enforced at three layers:

| Layer | Mechanism |
| - | - |
| **Identity** | Each request carries a tenant-scoped JWT. Cross-tenant calls are rejected at the gateway |
| **Database** | Per-tenant row-level isolation; queries are filtered by tenant ID at the query layer |
| **Storage** | Object storage prefixed by tenant ID; signed URLs scoped to a single tenant + role |

## Network topology

* **Public ingress** — only via your Dimension address (`<your-tenant>.dimension.io`) over TLS 1.2+, with every public endpoint protected by AWS WAF
* **Outbound calls** from Data Feeds and Webhook Actions go through a **per-request egress allowlist** — destinations are recorded in Request History
* **Inter-service traffic** stays inside our AWS VPC and goes via private endpoints; no traffic leaves the AWS region during normal operation

## Encryption

| At rest | In transit |
| - | - |
| AES-256 server-side encryption on RDS, S3, EBS | TLS 1.2+ on every external endpoint |
| AWS KMS for envelope encryption of secrets | mTLS on inter-service traffic where applicable |
| AWS Secrets Manager for auth tokens, API keys, signing secrets | Strict HSTS on all public endpoints |

## Key management

* **Customer-facing secrets** — auth credentials you paste into a Data Feed or Action (e.g. CrowdStrike Client ID/Secret) are stored in AWS Secrets Manager, encrypted with KMS, and never displayed in plain text after creation
* **Platform secrets** — managed via AWS IAM + Secrets Manager rotation
* **Bring-your-own-key (BYOK)** — available on the Enterprise plan; contact your account manager

## Backup & disaster recovery

* **Automated daily backups** of every tenant database
* **Point-in-time recovery (PITR)** within the retention window
* **Cross-AZ replication** in every supported region

## Logging, monitoring, audit

* **Audit Log** (Settings → Logs) records every platform-changing event
* **Request History** records every outbound HTTP call from Data Feeds and Actions
* **Platform telemetry** — request rates, error rates, latency — emitted to internal observability tooling; **never** contains customer data values
* **Infrastructure monitoring** — AWS CloudTrail and CloudWatch provide audit logging and monitoring across the infrastructure, and AWS GuardDuty provides continuous threat detection across the AWS environment

## Incident response

* **Detection** — automated alerts on anomalous activity, plus a customer-facing security inbox (`security@threataware.com`)
* **Response** — incident commander assigned within one business hour for severity-1 incidents
* **Customer notification** — affected customers contacted within the timeline required by their contract or applicable law (GDPR, HIPAA, etc.)
* **Post-incident** — public post-mortem for any incident affecting customer data confidentiality, integrity, or availability

## Vulnerability management

Our infrastructure is monitored continuously as part of our secure development lifecycle (SDLC):

* **Code and containers** — Aikido runs static code analysis (SAST), dependency scanning (SCA) and container image scanning. Vulnerabilities are flagged at commit and build time and stopped before they reach production.
* **Threat detection** — AWS GuardDuty provides continuous threat detection across our AWS environment.
* **Penetration testing** — regular independent penetration tests of the platform.
* **Reporting a vulnerability** — email `security@threataware.com`.

The scanning covers the whole platform, including the runtime every Studio app runs on, so apps are covered continuously, not only when they're published.

### Security tooling

| Tool | What it does |
| - | - |
| **Aikido** | Static code analysis (SAST), dependency (SCA) and container image scanning |
| **AWS GuardDuty** | Continuous threat detection across the AWS environment |
| **AWS WAF** | Protects all public endpoints |
| **AWS Secrets Manager & KMS** | Secrets storage and encryption key management |
| **AWS CloudTrail & CloudWatch** | Audit logging and monitoring across the infrastructure |
| **Penetration testing** | Regular independent tests of the platform |

## AI provider isolation

When **Cross-origin models** is enabled under Settings → AI, Composer can use Claude models from Anthropic that aren't available in your region, under Anthropic's published data-handling agreements. Requests to those models may be processed outside your region. Key facts:

* Routing happens **per-request**, not per-tenant — there's no persistent provider account holding your data
* Schema-only mode (the default) keeps actual data values out of the prompt regardless of provider
* Cross-origin models is a **tenant-wide opt-in**, Super Admin only, and audited in the Audit Log

## High-level data flow

A typical Studio app request flow:

1. User hits a Studio app via their browser
2. Browser → CloudFront → ALB → Dimension gateway (TLS 1.2+ throughout)
3. Gateway verifies the user's JWT, extracts tenant scope, forwards to Dimension API
4. Dimension API queries the tenant's data via the row-level-scoped database
5. App code runs server-side in a per-request sandbox; results returned to the browser
6. Every step logged to the Audit Log + telemetry pipeline

No customer data leaves the AWS region during this flow. Outbound calls (Data Feeds, Webhook Actions) are explicit, recorded in Request History, and signed where applicable.

## Architecture review

For a full architecture deep dive — diagrams, sub-processor list, BAA, DPA — email `security@threataware.com` or contact your account manager. NDA available on request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.