Shipped capabilities and honest gaps for assessor review-privileged action audit, signing policy, tenant isolation, and rate limiting with explicit non-certification framing for enterprise and government diligence.
Govern privileged automation with signing, separation of duties,and exportable audit-beside your RMM, verifiable in a Govern early access tenant.
Industry-recognised CIA model mapped to Trustholm controls you can verify in Govern early access.
Each MSP tenant has its own database schema. Customer-level scope fixes inside a tenant are in progress.
Signed scripts and four-eyes approval before production execution.
Shared infrastructure protected with rate limits and abuse resistance.
Privileged automation needs the same rigor as payment verification-cited industry data, not fear marketing.
Privileged script runs need the same rigor as payment verification-unsigned automation is a recurring assessor finding.
Remote access is the main ransomware path. Govern records who ran which signed script, where.
Signed scripts only-unsigned blocked when policy requires it.
Script signing policy · Security Center
Learn moreFour-eyes approval-the submitter cannot self-approve.
Dual-custody toggle · script.dual_custody.denied in audit
Learn moreTime-boxed technician privileges with approval, justification, and MFA - exportable for assessors.
Settings → Security · PrivilegeElevation audit · opt-in
Learn moreWho ran what, when, on which machine-exportable for assessors.
/audit · Event Hub/DCR sinks · compliance matrices
Learn moreOne unified narrative-persona-specific entry points for MSP, enterprise, and government buyers.
Supply-chain breach stats, insurer questionnaires, and per-customer Sentinel routing for end-customer audits.
View persona guide →Management-plane audit separate from RMM ops logs. SSO/MFA/RBAC and SIEM handoff via Event Hub/DCR.
View persona guide →ISM/PSPF consumer-responsibility framing-no IRAP badge claims. Govern early access evidence script for assessors.
View persona guide →“In regulated environments, assessors do not reward vague security claims-they reward reproducible evidence. We publish what is shipped, what is not, and how to verify both in your Govern early access tenant.”
Visual summary before evidence tables below.
Trust evidence
Shipped capabilities and honest gaps for assessor review-privileged action audit, signing policy, tenant isolation, and rate limiting with explicit non-certification framing for enterprise and government diligence.
Trustholm provides tenant-scoped security audit, PowerShell signing enforcement, schema-per-tenant isolation, and exportable evidence designed for customer security questionnaires and SOC 2-style control mapping. We describe what a reviewer can open in the UI or call on the API with normal credentials.
Privileged actions audit: Security-relevant events-admin changes, script publish and approval, signing policy updates-land in the security audit table. Operators export JSON or CSV via GET /api/audit/export with category and datetime filters. This is separate from HTTP request logs, which serve operational troubleshooting and include tenant enrichment in Serilog when deployed.
Security Center posture: Tenant administrators see MFA status, SSO mode, audit logging toggle, and script signing flags on /security. The practitioner checklist deep-links to evidence surfaces; it is not a substitute for your ISMS.
Script integrity: Tenant signing policy blocks unsigned execution when required. Platform script catalog patterns support standardized operations with reserved built-in tags. Attribution records who published, approved, and queued execution.
Tenant isolation: Each tenant receives a dedicated PostgreSQL schema. Portal users with JWT TenantId claims are bound to the resolved tenant-mismatch returns 403. Agent paths use tenant code headers and per-agent polling credentials.
Rate limiting and abuse resistance: Distributed rate limiting (Redis-backed with in-process fallback) caps agent ingest and portal traffic. Heavy endpoints use concurrency middleware. Tune limits under platform settings; Super Admins calibrate via /super-admin/rate-limits.
What we do not claim: Vendor SOC 2 Type II, ISO 27001, IRAP, or Essential Eight attestation. WORM audit storage is backlog. Hash-chain verification is built; database operators can still change rows. Event Hub/DCR audit sink is built and not yet verified end-to-end in a hosted lab. Splunk/Datadog connectors are backlog. Pair product artifacts with your policies, pentest results, and infrastructure monitoring.
Questionnaire acceleration: Security reviewers repeatedly ask about audit export, MFA, tenant isolation, and signing. This page consolidates answers with API paths so sales engineering does not improvise. Govern early access tenants should reproduce each Shipped row during diligence calls.
Rate limit and abuse narrative: Distributed rate limiting protects shared infrastructure; document tuning practices in your vendor risk file. Heavy endpoint concurrency caps prevent portal saturation during incident response-relevant for CC7 availability discussions when paired with your monitoring.
Agent integrity: Signed installers, polling credentials, and tenant-bound runtime are part of security story-not only portal IAM. Include agent distribution controls in endpoint management sections of customer questionnaires.
Package these artifacts for enterprise security reviews: (1) redacted JSON audit export with script lifecycle categories; (2) Security Center screenshot showing MFA, SSO mode, audit toggle, signing flags; (3) role matrix export mapped to your IdP groups; (4) architecture diagram annotating schema-per-tenant and JWT binding; (5) limitations memo listing WORM audit and vendor SOC 2 status; (6) rate-limit configuration summary from production or Govern early access; (7) agent installer signature verification steps from your deployment runbook.
Version the ZIP quarterly. During live review calls, reproduce export in shared screen-not slide-only walkthroughs.
When customers ask for penetration test attestation, share only reports your organization has explicitly authorized for redistribution under NDA; Trustholm has no third-party pentest report yet. Map each file to questionnaire row IDs in a cover spreadsheet so assessors navigate quickly.
This pack accelerates diligence; it does not replace your SSP or certification program.
Continuous monitoring: Assign owner to review trust hub diff each release; update customer-facing ZIP within five business days when Shipped/Gap rows change materially.
Board reporting: Summarize Shipped versus Gap counts quarterly for leadership-transparency reduces surprise findings in enterprise deals and supports honest pipeline qualification.
Customer success alignment: Account teams should not promise certification outcomes in renewal decks-reference trust hub version date and attach limitations slide for regulated accounts. Include link to product evidence map themes when customers request roadmap assurances.
Security reviewers should schedule annual re-validation of Shipped rows in Govern early access tenants and archive dated screenshots for contract renewals and board risk committees.
Third-party risk integration: When your GRC platform scores vendor risk, attach trust hub Shipped/Gap counts as quantitative input-not a substitute for your pentest and IR evidence. Refresh scores when limitations blocks change so procurement dashboards reflect current product posture rather than stale onboarding assumptions.
Pair this page with downloadable trust pack artifacts when customers request vendor due diligence beyond web copy alone.
This page describes product capabilities for your control matrix. Trustholm does not hold SOC 2, ISO 27001, IRAP, Essential Eight, CMMC, Cyber Essentials, NIS2, or framework certification badges.
| Topic | Evidence | Status | Notes |
|---|---|---|---|
| Just-in-time privilege elevation | Settings → Security JIT policy + grant queue; audit PrivilegeElevation / jit.privilege.*; Assessor Package can include elevation lifecycle | Shipped | Default off; Phase 2 packages, settings/agent/user gates, eligible roles, justification and break-glass policies shipped |
| Privileged actions audit | Web Audit logs (/audit); GET /api/audit, export JSON/CSV | Partial | Built; end-to-end export walk not yet completed. |
| Audit immutability | Append-only rows in normal application flows; per-tenant integrity hash chain with Security Centre verify/repair | Partial | WORM audit storage is backlog. Hash-chain verification is built; database operators can still change rows. |
| Security Center posture | MFA, SSO mode, audit logging, script signing flags | Shipped | - |
| Tenant isolation (MSP to MSP) | Schema-per-tenant PostgreSQL; JWT tenant binding (403 on mismatch) | Partial | Built; not yet verified in a hosted environment. |
| Customer scope inside a tenant | Delegated customer scope on software deployment, agent commands, probe deploy | Gap | Fixes in progress (WO-ZTR-312/313/316/322/323); not shipped until committed, deployed and verified. |
| Script signing | PowerShell code signing policy enforcement | Shipped | - |
| Process sandboxing | Opt-in sandboxPolicy on script execution; agent sandboxReport in audit export | Partial | Tier 1-2 on Server 2016+; enhanced network isolation on Server 2022+ |
| Dual-custody (four-eyes) | Settings → Security toggle; Script Management blocks submitter self-approve | Shipped | On by default; ERR_DUAL_CUSTODY_VIOLATION and script.dual_custody.denied in audit |
| Microsoft Sentinel / Event Hub audit sink | azure_eventhub / azure_dcr sink; DCR template download; per-customer routing | Partial | Event Hub/DCR audit sink is built and not yet verified end-to-end in a hosted lab. Splunk/Datadog connectors are backlog. |
| Audit export sinks (webhook) | HMAC webhook sink via GET/POST /api/tenant/audit-sinks | Shipped | - |
Govern is in early access and has no production SLA yet. Availability, RTO and RPO will be set in your contract before production use. Distributed rate limiting (Redis-backed) is built into the API.
We monitor regulatory and framework changes to map product capabilities to buyer questionnaires. We do not hold SOC 2 Type I or Type II and do not claim an observation period. SIG Lite pre-fill and Shipped/Gap tables accelerate your assessor mapping. Your audit firm owns attestation; we supply technical artifacts. We do not automate your SOC 2 Trust Services Criteria like a GRC tool.
We keep an incident response runbook (preparation, identification, assessment, response, review). Notification terms go in your contract.
Australia is the planned first region. EU hosting is by enterprise arrangement. Your region is agreed in writing during onboarding. See /trust/subprocessors for processor list.
Event Hub/DCR audit sink is built and not yet verified end-to-end in a hosted lab. Splunk/Datadog connectors are backlog. Plan interim JSON/CSV ingestion where needed.
No certification is claimed here. We provide audit export, IAM evidence, and isolation documentation for your assessor to map to CC6/CC7 themes in your program.
Attach redacted export samples and Security Center screenshots to customer diligence ZIP files. When questionnaires ask yes/no for SOC 2, use the comment field to explain artifact-based evaluation.
Your audit firm owns attestation-we supply technical rows, not a vendor report.
Rows are append-only in normal application flows, but database operators with sufficient privilege could mutate data. WORM or hash-chain immutability is on the backlog-document this gap in your SSP.
Compensating controls include restricted DBA access, infrastructure change logging, and frequent export to customer-controlled immutable storage. Assessors accept honest gaps with compensating narrative more often than silent assumptions.
Use Web Audit logs at /audit or GET /api/audit/export with category, fromUtc, and toUtc parameters. Store exports in your GRC tool with retention matching policy. Split large windows to respect server row caps. Hash files at ingestion. During live audit calls, reproduce export in Govern early access tenant while screen sharing-faster than emailing stale CSV attachments.
No. We export audit JSON/CSV. Event Hub/DCR audit sink is built and not yet verified end-to-end in a hosted lab. Splunk/Datadog connectors are backlog. Forward HTTP logs separately for operational telemetry. Position Trustholm as authoritative for management-plane privileged actions, not all enterprise telemetry.
Agents use polling credentials, tenant-bound runtime, and signed installers per tenant. Endpoint AV, EDR, and hardening remain customer responsibilities-we document agent integrity paths honestly. Include agent distribution and runtime verification in endpoint control test plans separate from portal MFA reviews.
When UI or API surfaces change, we update evidence tables in git-reviewed docs and this trust hub. Govern early access tenants can verify rows independently of marketing copy. Subscribe your security distribution list to release notes or review trust hub quarterly if you depend on Trustholm for customer audits.