What a security or procurement review asks for first, in one place: where the software runs, what reaches us, who helps us run this website, which versions we support, and how to report a problem.
Last updated 27 September 2026
At a glance
Where it runs
On your hardware. Talon Labs does not host Talon Studio and offers no managed service.
What reaches us
None of the data an install holds. A Community key is never activated or checked in. An Enterprise key (not on sale yet) checks in about once a day, and every six hours in the weeks before it expires, with licence and server metadata — no usage, user or business data. Talon Studio also fetches the public file talonlabs.dev/releases.json to show when a new release is out, and then that release's notes from talonlabs.dev/changelog/studio.md. The requests carry no licence, usage or account data (our host logs their IP address like any request), and TALON_DISABLE_UPDATE_CHECK=true turns them off for air-gapped installs.
If we stop
A Community key is perpetual and verified offline, so an install on one keeps running whether or not Talon Labs does.
Stage
Talon Studio is in beta. Its container image is public.
During the beta the current release of Talon Studio is the supported one: v1.0.2-beta. Fixes, security fixes included, ship as a new release rather than as patches to older betas, so staying supported means moving the pinned image tag forward.
Product
Current release
Image tag
Helm chart
Talon Studio
1.0.2-beta
v1.0.2-beta
0.3.7
Signed images and notices
Signed images
Images are signed with Sigstore cosign by Talon Studio's publish workflow and carry a software inventory (SBOM) as a signed attestation — every image. Checking is optional; the install guide shows how.
Third-party notices
The image carries its own, beside its LICENSE: /app/NOTICE. Talon Studio also lists its open-source libraries and detection content in the app under Settings → Licenses.
None published yet. When there is one, it will be posted on this page and in the affected product's changelog, naming the affected versions and the release that fixes it. To report a problem, follow the vulnerability disclosure policy, which our security.txt points to as well.
Accessibility
Neither this site nor Talon Studio has had an accessibility audit, so we make no claim to meet WCAG or any other standard yet. If something here or in Talon Studio stops you doing what you came to do, write to support@talonlabs.dev. We will work on a fix and, in the meantime, get you what you needed another way.
What we do not have yet
No certification (SOC 2, ISO 27001) and no published third-party penetration test. We would rather say so than leave it to be inferred. If your review has a questionnaire, send it to security@talonlabs.dev and we will answer it directly.