Skip to content
Sign inGet started
Company pages
Trust & data

Security

Built for teams that cannot ship their data to a vendor cloud: Talon Studio runs on your hardware, encrypts what it stores, records what happens — and its AI agents propose while people approve.

The basics

Self-hosted
Studio runs on infrastructure you control — your own cloud, on-premises or air-gapped. Talon Labs has no access to an install, its data or its credentials unless you grant remote access for a support session.
Signed keys, checked offline
Every key is Ed25519-signed and verified locally against a public key built into the image. A Community key is never activated or checked in. An Enterprise key (not on sale yet) activates online and checks in about once a day, and every six hours in the weeks before it expires, to collect its renewal before it lapses; if our licence server cannot be reached, the key already held keeps working until its own expiry date.
Release check
Talon Studio also fetches the public file talonlabs.dev/releases.json to show when a new release is out, and then that release's notes from talonlabs.dev/changelog/studio.md. The requests carry no licence, usage or account data (our host logs their IP address like any request), and TALON_DISABLE_UPDATE_CHECK=true turns them off for air-gapped installs.
Secrets encrypted at rest
Credentials Studio stores are encrypted with a key generated on your server, which we never see, and are never returned by an API.
Your AI provider, your keys
AI features talk only to the provider you configure, with your own API key — a hosted model, or an OpenAI-compatible server inside your network. Prompts go from your server to that provider and never through Talon Labs.

Talon Studio

Studio ships as a single container with an embedded database and one /data volume. Your events, rules and SIEM credentials stay inside your network, and nothing about your environment is pooled with other customers.

One container, your infrastructure
The image bundles the app, an embedded PostgreSQL and the translation sidecar, with one persistent volume — deployable in your own cloud, on-premises or air-gapped.
Public detection content
By default Studio also pulls public detection content (SigmaHQ, Atomic Red Team, CISA KEV), and each sync loop can be switched off for air-gapped installs. The licence check-in and the release check are in the first section above.
Encrypted at rest
SIEM, AI and integration credentials are encrypted with TALON_ENCRYPTION_KEY — generated on first boot and kept on your volume — before they touch the database, and are never logged or returned by any API.
Secrets stay out of Git
Feed and connection credentials never travel in the Git-backed YAML: configuration is versioned, secrets are not.
SSO and MFA
Sign in with GitHub, Google or Microsoft Entra, or built-in credentials with TOTP MFA; admins can require MFA for every credentials user. Recovery codes are stored only as hashes.
Roles everywhere
Org roles (admin, engineer, analyst, readonly) plus per-workspace roles, with custom roles that can narrow who may approve and deploy. Public-API tokens carry explicit scopes and can be pinned to one workspace.
Audit and Git history
An append-only audit log (actor, action, target, IP and time, kept 365 days by default and exportable through the API), and every detection change is a Git commit with an author, a diff and one-click rollback.

Talon Studio's agents

Talon Claw's agents can read your evidence and draft work, but no agent, interactive or autonomous, can approve, merge or deploy. That boundary is enforced in the tool layer, not by prompt etiquette.

Propose-only tool catalogue
Every write tool stages a draft change request for human review. No tool in the catalogue performs an unmediated write.
Layered prompts, delimited data
An immutable system prompt sits above per-agent role instructions; operator-supplied content and external data (SIEM rows, MCP output) are handled as clearly delimited untrusted data.
Bounded autonomy
Autonomous runs are capped by per-org concurrency and daily-run limits, with a global kill switch that stops every agent run at once.
Guarded external tools
Tools from registered MCP servers are curated, and their action tools are queued for human approval, never run automatically.

How we use AI

In the product, agents propose and people decide. Anything an agent sends out of your company, or that cannot be undone, waits for a person. You choose the model, including one that runs on your own hardware, and we never see the prompts.
On this website, the assistant answers from our own documentation, using Anthropic's Claude. What it records, and for how long, is on Cookies & Analytics. It can be wrong; the documentation it cites is the authority.
The voices are synthetic. The agents you hear in Talon Studio speak with voices generated by the Kokoro speech model (or, until it has downloaded, your browser's own), not recordings of people.
We do not train models on your data, your prompts or your conversations with the assistant.

Reporting a vulnerability

Write to security@talonlabs.dev. What is in scope, what we ask of you, how quickly we answer and our safe-harbour commitment are in the vulnerability disclosure policy, and our security.txt points there too.

Not through general support
A suspected vulnerability goes to the security address, never to the support queue or the contact form.

WHAT THESE PAGES ARE ABOUT

Talon StudioSelf-hosted detection engineering
Create a Talon Labs accountA free Community key for Talon Studio