What data Talon Studio touches and where it goes — self-hosted, which is how it ships. Written to be read by a security team doing vendor due diligence, not as marketing copy.
Last updated 27 September 2026DRAFT — PENDING COUNSEL REVIEW
We do not ingest your logs
Talon Studio is metadata-only by design. It reads index names, sourcetype/field schemas, and small samples of events (for detection testing) from a SIEM connection you configure — it does not copy or store your organisation's raw log volume. Detections are authored as Sigma/native-query YAML and stored in a Git repository, not as a copy of your event data.
Self-hosted deployment
Everything runs inside your own infrastructure. Specifically:
Talon Studio runs as one container, with its embedded database and its detection Git repositories on one /data volume.
Stored credentials are encrypted at rest with a key generated on your server (TALON_ENCRYPTION_KEY), and are never logged or returned unmasked by an API.
Licences are verified offline. A Community key is never activated or checked in. An Enterprise key (not on sale yet) activates online and checks in about once a day, and every six hours in the weeks before it expires, sending the key itself (which names who it was issued to), an instance id, its activation token once it has one, a check-in counter, the app version and the server's hostname — no usage, user or business data. If our licence server cannot be reached, the key already held keeps working until its own expiry date.
Talon Studio also fetches the public file talonlabs.dev/releases.json to show when a new release is out, and then that release's notes from talonlabs.dev/changelog/studio.md. The requests carry no licence, usage or account data (our host logs their IP address like any request), and TALON_DISABLE_UPDATE_CHECK=true turns them off for air-gapped installs.
Studio also pulls public detection-content updates (SigmaHQ, Atomic Red Team and similar open sources) over HTTPS by default, and each sync can be disabled for air-gapped installs.
If you configure an AI provider (including a local Ollama instance), prompts go directly from your server to that provider — never through Talon Labs' infrastructure.
Talon Labs has no access to a self-hosted instance, its data, or its credentials, unless you explicitly grant remote access for a support session.
No hosted version
Talon Labs does not host Talon Studio and offers no managed service. If that changes, it will come with its own written terms, and this page will describe it before anyone is asked to use it.
Sub-processors
For the software, none: a self-hosted install sends Talon Labs none of the data it holds, so there is nothing to pass on and no data processing agreement is needed to run it. The release check and an Enterprise key's check-in, above, do reach this website, and carry only what is listed there. The providers that run this website and your Talon Labs account are listed, with what each one does, on Sub-processors.
Deletion
On a self-hosted install, deletion is yours and happens on your disk. In Studio, deleting a workspace removes its database rows and Git repository from your volume.
What this website keeps about you, and for how long, is in the Privacy Policy. Security or data-handling due-diligence questions: security@talonlabs.dev.