Answer the question before it is asked.

02

Data handling

Exactly what Talon collects, exactly what it does not, retention per class, and what is redacted before anything reaches a model provider.

Last reviewed 2026-07-22 · Security engineering

What Talon collects

• +Running process list — image name, PID, parent, CPU and memory, signature status. Not command-line arguments, which routinely contain credentials.
• +Service and daemon states, start type, last exit code, and dependency status.
• +Windows Event Log slices scoped to System, Application and the specific provider relevant to an open incident. Time-bounded to the incident window.
• +Disk capacity and free space per volume, memory pressure, uptime, and thermal state.
• +Installed software inventory: name, version, publisher, install date.
• +Network adapter state: adapter presence, link status, IP configuration, DNS servers, default route, VPN tunnel state.
• +Recent change events: package installs, driver updates, OS patch history, and Kestrel’s own prior actions on the device.
• +Hardware and OS identity: model, serial, OS build, architecture, domain or MDM enrollment state.

What Talon does not collect

This list is enforced by what the agent implements, not by a configuration setting. There is no collector for any of it.

• −Keystrokes. There is no keyboard hook.
• −Screen contents. There is no capture path, and no remote-view feature.
• −File contents. Talon reads file metadata for diagnostics — size, timestamp, path — and never the bytes.
• −Browser history, bookmarks, cookies, or stored credentials.
• −Clipboard contents.
• −Microphone or camera. The agent requests no such permission and holds no such entitlement, which is verifiable in the notarised macOS bundle and the Windows manifest.
• −Personal document metadata outside diagnostic scope. The agent does not enumerate user home directories.
• −Geolocation beyond the network egress region already visible to your own infrastructure.

Retention

Data residency

Tenant data is pinned to one region at creation and does not move. Available: us-east, eu-west (Ireland), and eu-central (Frankfurt). ap-southeast is on the roadmap for Q1 2027 and is not available today — if you need it now, we are not the right vendor yet and would rather say so.

What leaves your region for the model provider

Diagnosis runs against Claude via the Anthropic API. Before any payload leaves our infrastructure it passes through a redaction stage we call the scrub pass, which runs on every field without exception and cannot be disabled per-tenant.

• ·Usernames and email addresses are replaced with stable per-tenant pseudonyms. The mapping never leaves your region.
• ·Hostnames are pseudonymised while preserving their naming-convention shape, because the shape is diagnostically useful and the name is not.
• ·IP addresses, MAC addresses and serial numbers are replaced with stable tokens.
• ·Anything matching credential, key, token or connection-string patterns is dropped rather than tokenised — a redacted secret is still a secret in a log.
• ·Free-text ticket bodies are passed through, because the requester’s own words are the highest-value diagnostic signal. Zero-retention mode is available if your policy forbids this, at a measurable cost to diagnosis quality that we will quantify for your fleet.

03

Encryption & key management

mTLS everywhere, per-device certificates issued at enrollment, KMS-backed key hierarchy, and what happens on compromise.

Last reviewed 2026-07-15 · Security engineering

In transit

• ·Agent to cloud: gRPC over mutual TLS 1.3. The agent presents a per-device client certificate issued at enrollment; the cloud presents a certificate pinned to our intermediate. Both sides verify. There is no fallback to server-only TLS.
• ·Layered on the mTLS channel, a short-lived session token scoped to one device and one tenant, valid 15 minutes, refreshed over the same authenticated channel.
• ·Browser to cloud: TLS 1.3, HSTS with preload, and no support for TLS 1.1 or below.
• ·Cloud to your ticketing system: TLS 1.2 minimum, certificate validation enforced, no option to disable it.

At rest

• ·AES-256-GCM for all stored data, on managed storage with encryption enabled at the volume layer as well.
• ·Connector credentials use envelope encryption: a per-tenant data key wrapped by a KMS customer master key. Plaintext data keys exist only in process memory during a call.
• ·Connector credentials are never returned by any API response, never rendered back into the UI after save, and are scrubbed from application logs by a filter with its own test suite.

Key hierarchy and rotation

De-enrollment and compromise

When a device is de-enrolled, its certificate is revoked immediately and published to the CRL and OCSP responder. The agent, if still running, receives a stand-down over the independent Recall channel and stops acting. Telemetry stops. Historical Flightlog entries for that device are retained, because deleting the audit record of a device you just removed is exactly backwards.

If you believe a device certificate is compromised, revocation is a single call and is effective on the next connection attempt — under 30 seconds in practice. A revoked certificate cannot be used to enrol a new device; enrollment requires a separate, single-use Manning token.

04

The Quarry review pipeline

Every remediation action is authored as code, peer-reviewed by a security engineer, sandbox-tested, tiered, signed and versioned. The manifest schema is published.

Last reviewed 2026-07-28 · Security engineering

Quarry is the entire vocabulary of things Kestrel can do to a machine. Publishing our internal review process for it is unusual. We do it because the process is the control, and a control you cannot inspect is a control you have to take on faith.

The gate, in order

• ·Authored as code in the Quarry repository, with a declarative manifest. Never a script pasted into a console.
• ·Peer review by a named security engineer, who is not the author, and who has an unconditional veto. CODEOWNERS enforces it.
• ·Sandbox fleet: executed against a dedicated fleet spanning every supported OS build, including deliberately broken machines. Rollback is exercised on every run, not just the failure runs.
• ·Risk tier assigned from observed blast radius, not from author intent.
• ·Reversibility declared with a rollback procedure that has been tested. An action cannot be marked reversible without a rollback that ran.
• ·Signed and versioned into a bundle. Bundles are immutable; a fix is a new version, never an edit.
• ·Staged release through the Quarry channel, which is separate from the Talon binary channel so a remediation fix does not require a fleet-wide agent update.

The manifest schema

This is the real shape. Every field is mandatory except preconditions. The reference published in the docs is generated from these manifests at build time — there is one source, and hand-editing the reference fails CI.

id: quarry.printspool.restart
version: 4.2.0
platforms: [windows]
risk_tier: 0
reversible: true
rollback:
  procedure: restore-service-state
  tested_against: [win10-22h2, win11-23h2, win11-24h2, ws2019, ws2022]
requires_privilege: elevated
privilege_scope: single-call          # escalate, act, drop — in one function
max_duration_seconds: 60
parameters:
  clear_queue:
    type: boolean
    default: true
    description: Delete queued jobs in the spool directory before restart.
preconditions:
  - service_exists: Spooler
  - device_health: [healthy, degraded]
verification:
  - service_state: {name: Spooler, expect: running}
  - test_print: optional
review:
  author: <redacted>
  security_reviewer: <redacted>        # never the author
  sandbox_run: 2026-07-19T09:14:22Z
  signature: sha256:9f2b1c7ae04d…c81a

Risk tiers

05

Autonomy, control & Recall

How Creance is scoped, how autonomy is earned with evidence, and the kill switch that works when everything else does not.

Last reviewed 2026-07-22 · Security engineering

What a rule can be scoped by

• ·Action identifier, or an action category, or a risk tier.
• ·Device group — static membership, or dynamic by OS, version, tag, directory OU, location or check-in recency.
• ·Reversibility requirement.
• ·Time window, evaluated in the device’s local timezone, not the tenant’s.
• ·Rate limits per device, per group, per hour and per day.
• ·Device health preconditions.
• ·User context — the exclusion of executive or VIP groups is a first-class field, because every enterprise asks for it.
• ·Maintenance-window awareness.
• ·Required approver role, for approval-gated outcomes.

Precedence

Deny always wins. More-specific scope beats less-specific. The resolution order is displayed in the policy UI on every rule, along with which other rules it interacts with. Silent precedence is how security policy interfaces cause incidents, so we show it whether or not anyone asks.

Earning autonomy with evidence

Autonomy is not a switch you flip on day one. An action accumulates a record under human approval; when that record is strong enough, the console proposes a scoped promotion with the evidence attached: “this action ran 214 times under approval with a 100% success rate and zero rollbacks — promote to unattended for Standard Laptops, business hours?” You accept a specific scope, not a general permission. Before saving, the simulator replays your last 30 days of Flightlog against the draft policy and shows exactly what would have changed.

Recall — the kill switch

Recall stands every agent down. It is reachable in one click from every screen in the console, and it is deliberately not behind a settings page or a “danger zone” accordion. Confirmation requires typing the word RECALL and shows the blast radius first: how many devices, how many actions in flight.

• ·Scope: global, per tenant, per device group, or per device.
• ·Effect: every agent in scope stops acting within 5 seconds. In-flight multi-step actions halt and roll back to their last checkpoint.
• ·Telemetry continues. You do not lose visibility at the moment you most want it.
• ·Independence: the stand-down travels on a channel separate from the orchestration path, with its own endpoint, its own credentials and its own health. Recall works when Stoop is down. We verify this in staging by taking orchestration fully offline before every release, and the test is a release blocker.
• ·Agents that are offline when Recall fires receive the stand-down as the first message on reconnect, before any work is dispatched to them.
• ·Recall is itself an audited action: who, when, from where, what scope, and how many devices acknowledged.

06

Compliance

SOC 2 status stated honestly with dates, control mapping, GDPR posture, sub-processors, pen-test cadence and disclosure policy.

Last reviewed 2026-07-30 · Security engineering

Control mapping

GDPR and CCPA

• ·Kestrel is a processor. You are the controller for device and ticket data.
• ·A DPA is available and is signed at contract, not on request after the fact.
• ·Standard Contractual Clauses for transfers out of the EEA, with the transfer impact assessment provided.
• ·Data subject requests: deletion and export within 30 days, with the exception of audit records under an active legal hold, which is itself an audited state.
• ·Sub-processor list below is generated from a single source file that also feeds the DPA appendix, so the two cannot disagree. Change notification is 30 days in advance, by email subscription.

Testing

Vulnerability disclosure

security@kestrel.io is monitored by a human, and /.well-known/security.txt is served on every Kestrel domain. We acknowledge within one business day, agree a disclosure timeline with you, and we do not use legal threats against good-faith researchers. There is no bounty programme yet; we say so rather than implying one.

Sub-processors

Generated from content/subprocessors, the same source that produces the DPA appendix, so the two cannot disagree. Subscribe at security@kestrel.io for 30-day change notice.

07

Shared responsibility

What Kestrel secures, and what you must configure. Enterprise reviewers look for this table specifically.

Last reviewed 2026-07-15 · Security engineering

08

Incident response

Severity definitions, notification SLAs, escalation path, and the post-incident commitment.

Last reviewed 2026-07-15 · Security engineering

What we will tell you

• ·What happened, in plain language, including what we do not yet know.
• ·Which of your devices, tenants and data classes were in scope — specifically, from Flightlog, not estimated.
• ·What actions were executed, by whom or by what, with the authorizing policy version.
• ·What we did to contain it, and at what time.
• ·What you need to do, if anything.

A first notification will not be delayed to make it complete. We would rather send you an incomplete SEV-1 notice inside four hours and follow it than a tidy one on day three.

Escalation

Your named security contact is notified by email and by the webhook you configure. For SEV-1, a human calls. You may escalate at any time to security@kestrel.io, which pages the on-call security engineer directly and does not route through support.

09

Document shelf

Self-serve access to the artifacts a vendor review actually needs, including a pre-filled CAIQ-Lite.

Last reviewed 2026-07-30 · Security engineering

Everything a security reviewer normally has to email for. The CAIQ-Lite is the highest-leverage item on this page: it is pre-filled, answer by answer, against what is actually implemented, and it saves your team roughly a week.

• Security whitepaper

  available

  Architecture, threat model, and the four invariants in detail.

  no gate — direct download

• CAIQ-Lite, pre-filled

  available

  Cross-checked line by line against implementation by a security engineer.

  no gate — direct download

• Architecture whitepaper

  available

  Data flow diagrams, trust boundaries, and the agent privilege model.

  no gate — direct download

• Data Processing Agreement

  available

  With the sub-processor appendix generated from the same source as this page.

  no gate — direct download

• Penetration test summary

  available

  Most recent third-party test. Findings and remediation status.

  click-through NDA required

• SOC 2 Type II report

  pending

  Observation window open since 12 April 2026. Target Q1 2027.

  click-through NDA required

• Insurance certificate

  available

  Technology E&O and cyber liability, with the endpoint-action endorsement.

  click-through NDA required

10

The hostile questions

The questions a security lead actually asks, answered directly, including where the answer is “not yet”.

Last reviewed 2026-07-28 · Security engineering