Confidentiality
MSP customer data stays structurally separated at the database layer.
- Schema-per-tenant PostgreSQL
- JWT tenant binding (403 on mismatch)
- Per-agent polling credentials
- DedicatedDatabase tier for enterprise
Security & Evidence
Shipped capabilities and honest gaps for assessor review-privileged action audit, signing policy, tenant isolation, and rate limiting with explicit non-certification framing for enterprise and government diligence.
Security standard for privileged automation
Govern privileged automation with signing, separation of duties, and exportable audit-beside your RMM, verifiable in a trial tenant.
Confidentiality, integrity, availability
Industry-recognised CIA model mapped to Trustholm controls you can verify in trial.
Integrity
Signed scripts and four-eyes approval before production execution.
- PowerShell code signing policy
- Dual-custody (four-eyes) on by default
- Append-only security audit plane
- Opt-in process sandboxing
- Just-in-time privilege elevation (opt-in)
Availability
Shared infrastructure protected with rate limits and abuse resistance.
- Redis-backed distributed rate limiting
- Heavy endpoint concurrency caps
- Operator-owned BCP/DR documented in trust pack (Trustholm does not run customer DR restore)
- RTO/RPO assumptions confirmed at contract onboarding
Why script governance matters now
Privileged automation needs the same rigor as payment verification-cited industry data, not fear marketing.
69%MSP leaders reporting 2+ breaches in 12 months
MSPs remain a supply-chain target
Privileged script runs need the same rigor as payment verification-unsigned automation is a recurring assessor finding.
80%Ransomware incidents correlated with remote access tools (2024)
Remote access is the ransomware path
RMM and remote management tools sit in the blast radius-govern execution and export attributable audit.
<30mTypical time to first audit export in trial
Buyers demand automation governance proof
Export audit rows in trial and attach to insurer or enterprise questionnaires-no slide-only walkthroughs.
Three pillars of governed execution
Integrity
Signed scripts only-unsigned blocked when policy requires it.
Script signing policy · Security Center
Learn moreSeparation of duties
Four-eyes approval-the submitter cannot self-approve.
Dual-custody toggle · script.dual_custody.denied in audit
Learn moreJust-in-time elevation
Time-boxed technician privileges with approval, justification, and MFA - exportable for assessors.
Settings → Security · PrivilegeElevation audit · opt-in
Learn moreEvidence
Who ran what, when, on which machine-exportable for assessors.
/audit · Event Hub/DCR sinks · compliance matrices
Learn moreBuilt for your security review
One unified narrative-persona-specific entry points for MSP, enterprise, and government buyers.
MSPs & vCISOs
Supply-chain breach stats, insurer questionnaires, and per-customer Sentinel routing for end-customer audits.
View persona guide →Enterprise CISO
Management-plane audit separate from RMM ops logs. SSO/MFA/RBAC and SIEM handoff via Event Hub/DCR.
View persona guide →Government & regulated
ISM/PSPF consumer-responsibility framing-no IRAP badge claims. Trial evidence script for assessors.
View persona guide →“In regulated environments, assessors do not reward vague security claims-they reward reproducible evidence. We publish what is shipped, what is not, and how to verify both in your trial tenant.”
Security & Evidence
Visual summary before evidence tables below.
Trust evidence
Security & Evidence
Shipped capabilities and honest gaps for assessor review-privileged action audit, signing policy, tenant isolation, and rate limiting with explicit non-certification framing for enterprise and government diligence.
- WORM / hash-chain audit immutability is backlog
- Vendor SOC 2 Type II is not claimed (observation in progress)
- Splunk/Datadog native sink templates remain backlog
ZIPtrust pack available
Download trust materialsTrustholm provides tenant-scoped security audit, PowerShell signing enforcement, schema-per-tenant isolation, and exportable evidence designed for customer security questionnaires and SOC 2-style control mapping. We describe what a reviewer can open in the UI or call on the API with normal credentials.
Privileged actions audit: Security-relevant events-admin changes, script publish and approval, signing policy updates-land in the security audit table. Operators export JSON or CSV via GET /api/audit/export with category and datetime filters. This is separate from HTTP request logs, which serve operational troubleshooting and include tenant enrichment in Serilog when deployed.
Security Center posture: Tenant administrators see MFA status, SSO mode, audit logging toggle, and script signing flags on /security. The practitioner checklist deep-links to evidence surfaces; it is not a substitute for your ISMS.
Script integrity: Tenant signing policy blocks unsigned execution when required. Platform script catalog patterns support standardized operations with reserved built-in tags. Attribution records who published, approved, and queued execution.
Tenant isolation: Each tenant receives a dedicated PostgreSQL schema. Portal users with JWT TenantId claims are bound to the resolved tenant-mismatch returns 403. Agent paths use tenant code headers and per-agent polling credentials.
Rate limiting and abuse resistance: Distributed rate limiting (Redis-backed with in-process fallback) caps agent ingest and portal traffic. Heavy endpoints use concurrency middleware. Tune limits under platform settings; Super Admins calibrate via /super-admin/rate-limits.
What we do not claim: Vendor SOC 2 Type II, ISO 27001, IRAP, or Essential Eight attestation. WORM audit immutability is a documented gap. Event Hub/DCR Sentinel forwarding is shipped; Splunk/Datadog native connectors remain backlog. Pair product artifacts with your policies, pentest results, and infrastructure monitoring.
Questionnaire acceleration: Security reviewers repeatedly ask about audit export, MFA, tenant isolation, and signing. This page consolidates answers with API paths so sales engineering does not improvise. Trial tenants should reproduce each Shipped row during diligence calls.
Rate limit and abuse narrative: Distributed rate limiting protects shared infrastructure; document tuning practices in your vendor risk file. Heavy endpoint concurrency caps prevent portal saturation during incident response-relevant for CC7 availability discussions when paired with your monitoring.
Agent integrity: Signed installers, polling credentials, and tenant-bound runtime are part of security story-not only portal IAM. Include agent distribution controls in endpoint management sections of customer questionnaires.
Procurement evidence pack (starter)
Package these artifacts for enterprise security reviews: (1) redacted JSON audit export with script lifecycle categories; (2) Security Center screenshot showing MFA, SSO mode, audit toggle, signing flags; (3) role matrix export mapped to your IdP groups; (4) architecture diagram annotating schema-per-tenant and JWT binding; (5) limitations memo listing WORM audit and vendor SOC 2 status; (6) rate-limit configuration summary from production or trial; (7) agent installer signature verification steps from your deployment runbook.
Version the ZIP quarterly. During live review calls, reproduce export in shared screen-not slide-only walkthroughs.
When customers ask for penetration test attestation, share only reports your organization or Trustholm has explicitly authorized for redistribution under NDA. Map each file to questionnaire row IDs in a cover spreadsheet so assessors navigate quickly.
This pack accelerates diligence; it does not replace your SSP or certification program.
Continuous monitoring: Assign owner to review trust hub diff each release; update customer-facing ZIP within five business days when Shipped/Gap rows change materially.
Board reporting: Summarize Shipped versus Gap counts quarterly for leadership-transparency reduces surprise findings in enterprise deals and supports honest pipeline qualification.
Customer success alignment: Account teams should not promise certification outcomes in renewal decks-reference trust hub version date and attach limitations slide for regulated accounts. Include link to product evidence map themes when customers request roadmap assurances.
Security reviewers should schedule annual re-validation of Shipped rows in trial tenants and archive dated screenshots for contract renewals and board risk committees.
Third-party risk integration: When your GRC platform scores vendor risk, attach trust hub Shipped/Gap counts as quantitative input-not a substitute for your pentest and IR evidence. Refresh scores when limitations blocks change so procurement dashboards reflect current product posture rather than stale onboarding assumptions.
Pair this page with downloadable trust pack artifacts when customers request vendor due diligence beyond web copy alone.
This page describes product capabilities for your control matrix. Trustholm does not hold SOC 2, ISO 27001, IRAP, Essential Eight, CMMC, Cyber Essentials, NIS2, or framework certification badges.
| Topic | Evidence | Status | Notes |
|---|---|---|---|
| Just-in-time privilege elevation | Settings → Security JIT policy + grant queue; audit PrivilegeElevation / jit.privilege.*; Assessor Package can include elevation lifecycle | Shipped | Default off; Phase 2 packages, settings/agent/user gates, eligible roles, justification and break-glass policies shipped |
| Privileged actions audit | Web Audit logs (/audit); GET /api/audit, export JSON/CSV | Shipped | - |
| Audit immutability | Append-only rows in normal application flows; per-tenant integrity hash chain with Security Centre verify/repair | Partial | Database operators can still mutate tables. Product WORM storage remains backlog; operator-side Object Lock archive handoff is available. Hash-chain verification is shipped. |
| Security Center posture | MFA, SSO mode, audit logging, script signing flags | Shipped | - |
| Tenant isolation | Schema-per-tenant PostgreSQL; JWT tenant binding on API | Shipped | - |
| Script signing | PowerShell code signing policy enforcement | Shipped | - |
| Process sandboxing | Opt-in sandboxPolicy on script execution; agent sandboxReport in audit export | Partial | Tier 1-2 on Server 2016+; enhanced network isolation on Server 2022+ |
| Dual-custody (four-eyes) | Settings → Security toggle; Script Management blocks submitter self-approve | Shipped | On by default; ERR_DUAL_CUSTODY_VIOLATION and script.dual_custody.denied in audit |
| Microsoft Sentinel / Event Hub audit sink | azure_eventhub / azure_dcr sink; DCR template download; per-customer routing | Shipped | Splunk/Datadog native sinks and in-product detection rules remain backlog |
| Audit export sinks (webhook) | HMAC webhook sink via GET/POST /api/tenant/audit-sinks | Shipped | - |
Frequently asked questions
- How do you ensure system availability?
Production deployments use redundant infrastructure with RTO/RPO documented during enterprise onboarding-not generic marketing SLAs. Distributed rate limiting (Redis-backed) protects shared API capacity. Exact availability commitments appear in your contract and subprocessors page. Pair product rate limits with your own infrastructure monitoring for CC7-style narratives.
- How do you keep up with compliance and regulatory obligations?
We monitor regulatory and framework changes to map product capabilities to buyer questionnaires. SOC 2 Type II observation is in progress-we do not claim Type II certification. SIG Lite pre-fill and Shipped/Gap tables accelerate your assessor mapping. Your audit firm owns attestation; we supply technical artifacts. We do not automate your SOC 2 Trust Services Criteria like a GRC tool.
- Do you have a Security Incident Response Plan?
We maintain an incident response runbook aligned to ISO/IEC 27035 phases: preparation, identification, assessment, response, and post-incident review. Enterprise contracts include notification schedules. A redacted IR summary is available in the full trust pack on request-contact security@trustholm.com.
- Where is data hosted?
Australia is the primary launch region. EU home region is available for pilot and enterprise tenants. Exact residency for your contract is confirmed during onboarding-not inferred from marketing copy. See /trust/subprocessors for processor list.
- Can we forward audit events to Microsoft Sentinel?
Yes. Event Hub/DCR audit sinks ship today (azure_eventhub / azure_dcr) with ASIM-mapped JSON, DCR template download, and optional per-customer routing for MSP resale. Splunk/Datadog native sink templates remain backlog-plan interim JSON/CSV ingestion where needed.
- Do you hold SOC 2 Type II?
No certification is claimed here. We provide audit export, IAM evidence, and isolation documentation for your assessor to map to CC6/CC7 themes in your program.
Attach redacted export samples and Security Center screenshots to customer diligence ZIP files. When questionnaires ask yes/no for SOC 2, use the comment field to explain artifact-based evaluation.
Your audit firm owns attestation-we supply technical rows, not a vendor report.
- Can database operators tamper with audit rows?
Rows are append-only in normal application flows, but database operators with sufficient privilege could mutate data. WORM or hash-chain immutability is on the backlog-document this gap in your SSP.
Compensating controls include restricted DBA access, infrastructure change logging, and frequent export to customer-controlled immutable storage. Assessors accept honest gaps with compensating narrative more often than silent assumptions.
- How do I export evidence for a review window?
Use Web Audit logs at /audit or GET /api/audit/export with category, fromUtc, and toUtc parameters. Store exports in your GRC tool with retention matching policy. Split large windows to respect server row caps. Hash files at ingestion. During live audit calls, reproduce export in trial tenant while screen sharing-faster than emailing stale CSV attachments.
- Does Trustholm replace my SIEM?
No. We export audit JSON/CSV and ship Event Hub/DCR sinks for Microsoft Sentinel. Forward HTTP logs separately for operational telemetry. Position Trustholm as authoritative for management-plane privileged actions, not all enterprise telemetry.
- What about agent endpoint security?
Agents use polling credentials, tenant-bound runtime, and signed installers per tenant. Endpoint AV, EDR, and hardening remain customer responsibilities-we document agent integrity paths honestly. Include agent distribution and runtime verification in endpoint control test plans separate from portal MFA reviews.
- How often is this evidence map updated?
When UI or API surfaces change, we update evidence tables in git-reviewed docs and this trust hub. Trial tenants can verify rows independently of marketing copy. Subscribe your security distribution list to release notes or review trust hub quarterly if you depend on Trustholm for customer audits.