Self-hosted by design, encrypted at rest, auditable end to end — and AI agents that can propose but never deploy.
Talon Studio ships as a single-container appliance with an embedded database and one /data volume. Self-hosted, your events, rules and credentials stay inside your network — there is no phone-home, and nothing about your environment is pooled with other customers.
The appliance bundles the app, an embedded Postgres and the translation sidecar in a single image with one persistent volume — deployable in your own cloud, on-prem or air-gapped.
Licenses are ed25519-signed and verified locally against a baked-in public key. There is no license server and no call home — the appliance runs fully disconnected.
The only default outbound calls pull public detection content (SigmaHQ, Atomic Red Team, CISA KEV) — and each sync loop can be disabled for air-gapped environments.
AI features talk only to the provider you configure with your own API key — Anthropic, OpenAI, xAI, or a self-hosted OpenAI-compatible endpoint inside your network.
Everything sensitive the platform stores — SIEM connections, AI provider keys, threat-feed auth — is encrypted at rest with a key you control.
SIEM, AI and integration credentials are encrypted with your ENCRYPTION_KEY before they touch the database, and are never logged or returned by any API.
Feed and connection credentials never travel in the Git-backed YAML — configuration is versioned, secrets are not.
The SOC alert-push webhook authenticates with a stateless per-workspace HMAC token — no inbound credential to store or rotate.
Access is default-deny and role-scoped at both the org and workspace level.
Sign in with GitHub, Google or Microsoft Entra, or built-in credentials with TOTP MFA (RFC 6238). Enrolment issues single-use recovery codes, stored only as hashes.
Admins can enforce MFA for every credentials user — un-enrolled users are held at their profile page until they enrol.
Org roles (admin / engineer / analyst / readonly) plus per-workspace roles (viewer / engineer / owner), with custom roles that can narrow who holds approve and deploy.
Public-API tokens carry explicit scopes and can be pinned to a single workspace; admin-only scopes can only be granted by an admin.
Every significant action lands in an immutable audit log — and every content change is a Git commit with an author, a diff and a history.
Actor, action, target, IP and timestamp for every significant event, retained for a configurable window (default 365 days).
Walk the full trail through the cursor-paginated audit-log API and archive it on your own schedule.
Detections live as Git-backed YAML; every edit, review and merge is permanently attributable — with one-click rollback.
Talon Claw's agents can read your evidence and draft work — but no agent, interactive or autonomous, can approve, merge or deploy. That boundary is enforced in the tool layer, not by prompt etiquette.
Every write tool stages a draft change request for human review. No tool in the catalog performs an unmediated write.
An immutable system prompt sits above per-agent role instructions; operator-supplied content and external data (SIEM rows, MCP output) are handled as clearly-delimited untrusted data.
Autonomous runs are capped by per-org concurrency and daily-run limits, with a global kill switch that stops all agent runs at once.
Tools from registered MCP servers are curated, and their action tools are queued for human approval — never auto-run.
We welcome responsible disclosure. Report security issues to our security team and we'll work with you on a fix and coordinated disclosure. Our security.txt has the details.
Self-host Talon Studio and prove every claim on this page against your own instance — the docs cover the full security model.