Skip to main content
Dimension is built on the same secure AWS infrastructure as the rest of the ThreatAware platform. Your security data stays yours — by default we never read it, share it, or train models on it.
Dimension inherits the ThreatAware platform’s security posture — same AWS account model, same encryption, same identity and access controls, same audit trail. This page covers the Dimension-specific behaviour layered on top of that base.

Data isolation

Every ThreatAware tenant is logically isolated:
  • Workspaces sit inside your tenant — none of your data is shared with other tenants
  • Apps, Data Feeds, and Actions are workspace-scoped. An app in workspace A can’t read anything in workspace B
  • Cross-tenant sharing — exported files contain only the item’s code and schema, never any data values

Apps are secure by design

Every Studio app gets the same protections from the platform, so its safety doesn’t depend on how well that one app was written:
  • Sandboxed, with no internet access. Every app runs in a sandboxed environment that can’t reach the internet.
  • Only its own data. An app can only read the data feeds explicitly connected to it.
  • Changes go through Actions. An app can only send data or make changes outside the platform through a sanctioned Action, and a person has to approve it. See Approving actions.
  • Platform controls for every app. Dimension provides the hosting, SSO, role-based access and audit logging, so every app gets the same security controls.
As a result, a flaw in an individual app can’t be used to exfiltrate data or reach external systems.

Are apps scanned for vulnerabilities?

Yes, continuously, not only when they’re published. The Dimension platform is scanned as part of our secure development lifecycle (SDLC), and that includes the runtime every app runs on. See Vulnerability management for how.

Schema-only AI access

By default, when Composer builds for you it sees the schema of your data — field names and types like deviceName: string, osVersion: string — but never the actual values.

Schema only (default)

AI sees: deviceName (string), osVersion (string), riskScore (number)AI does not see: LAPTOP-SALES-01, Windows 11 23H2, 87

Runtime execution

AI writes code that queries your dataCode runs in your tenant’s isolated environmentResults displayed only to authorised users

When the AI does see data values

Two opt-in settings under Settings → AI can change this default: Both are tenant-wide toggles, Super Admin only. Most teams leave both off; turn them on only after reviewing your data-handling policies.
If you turn AI data access on, real values can appear in Composer prompts and the generated code. Treat this exactly as you’d treat sharing the data with the provider — it leaves your isolated environment only via the AI API contract.

Access control & roles

Dimension respects ThreatAware’s main-platform access control. Users only see data they have permission to view; building or sharing a Dimension app does not grant additional access. Four built-in roles ship by default: Define custom roles under Settings → User Management → Roles.

Encryption

  • In transit — TLS 1.2+ for every connection in and out of Dimension
  • At rest — AES-256 server-side encryption on all stored data
  • Secrets — auth tokens, API keys and webhook signing secrets are stored in AWS Secrets Manager, with keys managed in AWS KMS, and never logged

Audit logging

Every platform-changing event lands in the Audit Log under Settings → Logs:
  • Workspace create / update / delete
  • App create / publish / unpublish / delete
  • Data Feed create / sync / fail
  • Action invocation
  • User create / update / role change / SSO enable
  • AI setting change
  • Import / Export entity
Columns: Action Title, Description, Platform Section, Email, Timestamp. Searchable and exportable.
Pair the Audit Log with your SIEM. Every Action invocation, every user change, every workspace edit is recorded here.
Request History records every outbound HTTP call (Data Feeds, Webhook Actions) — useful for debugging integrations and proving the absence of unwanted data flows.

SSO & MFA

  • MFA is recommended for every account
  • SSO is configurable tenant-wide under Settings → User Management → SSO

Data ownership & portability

All code generated in Studio is yours. Export at any time:
  • Single app — Studio editor → ⋯ → Advanced → Export produces an exported file with source, dependencies, schema, and a README
  • Full source — X-Ray (the < > icon in the editor) gives you a file-tree of the React/TypeScript source plus a Download Package button
Exported apps have no ThreatAware runtime dependencies. Run them anywhere a Node.js + React stack is supported.

Privacy & data residency

  • ThreatAware Dimension runs on AWS infrastructure in the regions your main ThreatAware tenant is hosted in
  • We do not sell, share, or aggregate your data with other customers
  • AI providers (where used) operate under their published data-handling agreements — see the Cross-origin models toggle for opt-in
For a current sub-processor list, data residency map, or detailed processing locations, contact security@threataware.com or your account manager.

Compliance & certifications

ISO 27001 Certified

Independently audited and certified to international information security standards

Private Infrastructure

Hosted on dedicated AWS infrastructure, isolated from shared environments

End-to-End Encryption

Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
See Certifications for current audit status and how to request evidence.

Reporting a vulnerability

Found a security issue? Email security@threataware.com. We aim to acknowledge within one business day and triage within three. Coordinated disclosure preferred — give us a chance to ship a fix before publishing.

Read more

Certifications

ISO 27001 scope, audit cadence, and how to request evidence

Architecture

AWS hosting, tenant isolation model, network topology

Settings → AI

The tenant-wide AI toggles that control what data the AI can see

Settings → Logs

Audit Log and Request History for forensic review