> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimension.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Video walkthroughs: the Dimension product overview video (https://www.youtube.com/watch?v=Mx8rg5wfkU0, also embedded at https://docs.dimension.io/overview) is the first of a series. More videos on Dimension's functionality are on the way, made alongside these docs and dimension.io. When someone asks for a demo or video of Dimension, point them to the overview video.

# Security & Privacy

> How Dimension protects your data — data isolation, AI controls, and access boundaries

Dimension is built on the same secure AWS infrastructure as the rest of the ThreatAware platform. Your security data stays yours — by default we never read it, share it, or train models on it.

> [!NOTE]
>
> Dimension **inherits** the ThreatAware platform's security posture — same AWS account model, same encryption, same identity and access controls, same audit trail. This page covers the Dimension-specific behaviour layered on top of that base.

## Data isolation

Every ThreatAware tenant is logically isolated:

* **Workspaces** sit inside your tenant — none of your data is shared with other tenants
* **Apps**, **Data Feeds**, and **Actions** are workspace-scoped. An app in workspace *A* can't read anything in workspace *B*
* **Cross-tenant sharing** — exported files contain only the item's code and schema, never any data values

## Apps are secure by design

Every Studio app gets the same protections from the platform, so its safety doesn't depend on how well that one app was written:

* **Sandboxed, with no internet access.** Every app runs in a sandboxed environment that can't reach the internet.
* **Only its own data.** An app can only read the [data feeds](https://docs.dimension.io/data-feeds.md) explicitly connected to it.
* **Changes go through Actions.** An app can only send data or make changes outside the platform through a sanctioned [Action](https://docs.dimension.io/actions.md), and a person has to approve it. See [Approving actions](https://docs.dimension.io/actions/approvals.md).
* **Platform controls for every app.** Dimension provides the hosting, SSO, role-based access and audit logging, so every app gets the same security controls.

As a result, a flaw in an individual app can't be used to exfiltrate data or reach external systems.

### Are apps scanned for vulnerabilities?

Yes, continuously, not only when they're published. The Dimension platform is scanned as part of our secure development lifecycle (SDLC), and that includes the runtime every app runs on. See [Vulnerability management](https://docs.dimension.io/trust/architecture.md#vulnerability-management) for how.

## Schema-only AI access

By default, when Composer builds for you it sees the **schema** of your data — field names and types like `deviceName: string`, `osVersion: string` — but **never the actual values**.

> [card] Schema only (default)
>
> AI sees: `deviceName (string), osVersion (string), riskScore (number)`
>
> AI does **not** see: `LAPTOP-SALES-01, Windows 11 23H2, 87`

> [card] Runtime execution
>
> AI writes code that queries your data
>
> Code runs in your tenant's isolated environment
>
> Results displayed only to authorised users

### When the AI does see data values

Two opt-in settings under **Settings → AI** can change this default:

| Setting | What it enables | Default |
| - | - | - |
| **AI data access** | Composer can read actual values, not just schema, for richer insights | Off |
| **Cross-origin models** | Composer can use Claude versions that aren't available in your region. Requests to them may be processed outside your region | Off |

Both are tenant-wide toggles, Super Admin only. Most teams leave both off; turn them on only after reviewing your data-handling policies.

> [!WARNING]
>
> If you turn **AI data access** on, real values can appear in Composer prompts and the generated code. Treat this exactly as you'd treat sharing the data with the provider — it leaves your isolated environment only via the AI API contract.

## Access control & roles

Dimension respects ThreatAware's main-platform access control. Users only see data they have permission to view; building or sharing a Dimension app does **not** grant additional access.

Four built-in roles ship by default:

| Role | What it can do |
| - | - |
| **Super Admin** | Everything — including Settings, User Management, SSO, AI controls |
| **Analyst** | Build, edit, publish apps; configure Data Feeds and Actions; cannot manage users or AI settings |
| **Viewer** | Read-only across the platform |
| **Limited Viewer** | Restricted read access — for guest auditors or external reviewers |

Define custom roles under **Settings → User Management → Roles**.

## Encryption

* **In transit** — TLS 1.2+ for every connection in and out of Dimension
* **At rest** — AES-256 server-side encryption on all stored data
* **Secrets** — auth tokens, API keys and webhook signing secrets are stored in AWS Secrets Manager, with keys managed in AWS KMS, and never logged

## Audit logging

Every platform-changing event lands in the **Audit Log** under Settings → Logs:

* Workspace create / update / delete
* App create / publish / unpublish / delete
* Data Feed create / sync / fail
* Action invocation
* User create / update / role change / SSO enable
* AI setting change
* Import / Export entity

Columns: Action Title, Description, Platform Section, Email, Timestamp. Searchable and exportable.

> [!TIP]
>
> Pair the Audit Log with your SIEM. Every Action invocation, every user change, every workspace edit is recorded here.

**Request History** records every outbound HTTP call (Data Feeds, Webhook Actions) — useful for debugging integrations and proving the absence of unwanted data flows.

## SSO & MFA

* **MFA** is recommended for every account
* **SSO** is configurable tenant-wide under Settings → User Management → **SSO**

## Data ownership & portability

All code generated in Studio is **yours**. Export at any time:

* **Single app** — Studio editor → **⋯ → Advanced → Export** produces an exported file with source, dependencies, schema, and a README
* **Full source** — X-Ray (the `< >` icon in the editor) gives you a file-tree of the React/TypeScript source plus a **Download Package** button

Exported apps have **no ThreatAware runtime dependencies**. Run them anywhere a Node.js + React stack is supported.

## Privacy & data residency

* ThreatAware Dimension runs on AWS infrastructure in the regions your main ThreatAware tenant is hosted in
* We do **not** sell, share, or aggregate your data with other customers
* AI providers (where used) operate under their published data-handling agreements — see the **Cross-origin models** toggle for opt-in

For a current sub-processor list, data residency map, or detailed processing locations, contact `security@threataware.com` or your account manager.

## Compliance & certifications

> [card] ISO 27001 Certified
>
> Independently audited and certified to international information security standards

> [card] Private Infrastructure
>
> Hosted on dedicated AWS infrastructure, isolated from shared environments

> [card] End-to-End Encryption
>
> Data encrypted in transit (TLS 1.2+) and at rest (AES-256)

See [Certifications](https://docs.dimension.io/trust/certifications.md) for current audit status and how to request evidence.

## Reporting a vulnerability

Found a security issue? Email `security@threataware.com`. We aim to acknowledge within one business day and triage within three. Coordinated disclosure preferred — give us a chance to ship a fix before publishing.

## Read more

> [card] [Certifications](https://docs.dimension.io/trust/certifications.md)
>
> ISO 27001 scope, audit cadence, and how to request evidence

> [card] [Architecture](https://docs.dimension.io/trust/architecture.md)
>
> AWS hosting, tenant isolation model, network topology

> [card] [Settings → AI](https://docs.dimension.io/settings.md)
>
> The tenant-wide AI toggles that control what data the AI can see

> [card] [Settings → Logs](https://docs.dimension.io/settings.md)
>
> Audit Log and Request History for forensic review


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.