You're trusting RedStrike with sensitive information about your attack surface. This page explains how we protect it — from tenant isolation to safe testing practices.

TL;DR

Data is isolated per organization, encrypted in transit and at rest, and cloud access is strictly read-only. Testing is non-destructive by design. We support SSO, scoped API keys, and audit logging, and we run a responsible-disclosure program.

Tenant isolation

Every object — targets, scans, findings, reports, integrations — belongs to exactly one organization, and queries are scoped to the caller's org at every layer. Data never crosses the organization boundary, whether accessed from the dashboard or the API.

Encryption

State	Protection
In transit	TLS 1.2+ for all API and dashboard traffic
At rest	Encryption of stored findings, evidence, and secrets
Secrets	Cloud credentials and API keys stored encrypted

Least-privilege cloud access

RedStrike's CSPM uses read-only roles (AWS SecurityAudit, Azure Security Reader, GCP Security Reviewer). It cannot modify or delete your cloud resources. Connections use short-lived credentials and external IDs where the provider supports them.

If any setup guide ever asks you to grant write access, stop — RedStrike does not need it. Grant only the read-only roles documented in Cloud Security.

Safe, authorized testing

Two principles govern active testing:

Authorization first. External targets require ownership verification before a scan can run. You are responsible for only testing assets you're allowed to.
Non-destructive by default. Verification confirms that an issue exists without exfiltrating data or damaging systems. You control intensity and rate limits to protect fragile production systems.

Access controls

SSO — connect your identity provider for centralized sign-in.
RBAC — four roles scope what each member can do (see Roles & Permissions).
Scoped API keys — least-privilege automation credentials you can rotate and revoke.
Audit logging — sensitive actions (scans, member changes, key creation) are recorded for review.

Data retention

Findings and reports are retained so you keep a defensible history and evidence trail. You control retention windows and can request deletion of an organization's data; deletion is irreversible.

Responsible disclosure

Found a vulnerability in RedStrike itself? We run a coordinated disclosure program. Report issues to our security team and we'll acknowledge, investigate, and remediate. Please don't publicly disclose before we've had a chance to fix.

Security contact: security@redstrike.io

This page summarizes practices for documentation purposes. For contractual commitments, current certifications, and our data processing terms, refer to your agreement and the Trust/Legal pages on the main site.

Security & Trust