Skip to main content
Reference

Security Overview

How Triform protects your data and systems

Our commitment to security

Security is fundamental to Triform. We implement industry-standard practices to protect your Projects, data, and credentials.

Data encryption

At rest

All data stored in Triform is encrypted using AES-256 encryption.

Encrypted data includes:

  • Project code and configurations
  • Execution logs and traces
  • Project Variables
  • API keys
  • User information
  • OAuth credentials and tokens — Securely encrypted using Scaleway KMS

Key management: Encryption keys are managed using industry-standard key management services (Scaleway KMS), rotated regularly, and never stored alongside encrypted data.

OAuth credential encryption

Scaleway KMS Integration:

  • Dedicated key management service for OAuth tokens
  • End-to-end encryption for third-party credentials
  • Automatic key rotation support
  • Secure encryption/decryption for token refresh
  • Organization-specific encryption keys created on signup

In transit

All communication with Triform uses TLS 1.2+ encryption.

Encrypted connections:

  • Web interface (HTTPS)
  • API requests (HTTPS)
  • Webhook callbacks (HTTPS)
  • Database connections (encrypted)
  • Internal service communication (mutual TLS)

Certificate management: We use trusted Certificate Authorities and monitor certificate expiration.

Authentication

Supported methods

OAuth 2.0 providers:

  • Discord
  • GitHub
  • Google
  • Microsoft

Email: Passwordless email authentication

Benefits:

  • No password management burden
  • Leverage provider security (2FA, etc.)
  • Single sign-on capabilities
  • Secure token refresh mechanisms

Session management

Security features:

  • Sessions expire after inactivity
  • IP address validation (optional)
  • Device fingerprinting
  • Concurrent session limits

User controls:

  • View active sessions
  • Revoke individual sessions
  • Revoke all sessions (sign out everywhere)

Two-factor authentication (2FA)

Strongly recommended for:

  • Organization Admins
  • Users with deployment permissions
  • Users handling sensitive Projects

Supported methods:

  • Authenticator apps (TOTP)
  • SMS (where available)
  • Backup codes

Enforcement: Organization Admins can require 2FA for all members.

Authorization

Role-based access control (RBAC)

Organization roles:

  • Admin — Full access
  • Editor — Create, edit, execute
  • Viewer — Read-only

Project-level permissions:

  • Fine-grained per-Project overrides
  • Specific user grants
  • Temporary access grants

API key security

Best practices enforced:

  • Keys are hashed in storage (irreversible)
  • Keys shown only once upon creation
  • Keys can be scoped to specific Projects
  • Keys can be restricted by permissions
  • Keys can expire automatically
  • Key usage is logged

User responsibilities:

  • Store keys securely (environment variables, secret managers)
  • Rotate keys regularly (90-day recommendation)
  • Revoke unused keys
  • Never commit to version control

OAuth token security

Enterprise-grade OAuth 2.0 implementation:

  • Secure credential storage — All OAuth tokens encrypted with Scaleway KMS
  • Automatic token refresh — Transparent refresh of expired tokens
  • Scope-based permissions — Fine-grained control over API access
  • Multi-provider support — Google, Microsoft, GitHub, GitLab, Slack, Linear, Notion, and more
  • Memcache layer — High-performance caching with TTL management
  • Provider-agnostic architecture — Consistent security across all OAuth providers

Token lifecycle management:

  • Tokens encrypted at rest using KMS
  • Secure token injection during action execution
  • Automatic refresh before expiration
  • Proper cleanup on revocation
  • Real-time token status via WebSocket

Network security

API security

Protection mechanisms:

  • Rate limiting (prevents abuse)
  • DDoS mitigation
  • Input validation and sanitization

Monitoring:

  • Anomaly detection
  • Suspicious activity alerts
  • Failed authentication tracking

Webhook security

Verification options:

  • API key authentication

Replay attack prevention:

  • Timestamp validation
  • Nonce tracking
  • Request idempotency

Code execution security

Sandboxed execution

Actions run in isolated environments:

Isolation features:

  • Separate containers per execution
  • No persistent file system
  • Limited network access
  • Resource quotas (CPU, memory, time)
  • No access to Triform internals

What Actions CANNOT do:

  • Access other users' data
  • Modify Triform infrastructure
  • Persist data between executions (unless using provided storage)
  • Execute arbitrary system commands
  • Fork processes or spawn daemons

Dependency security

Automated scanning:

  • Check for known vulnerabilities in dependencies
  • Alert on critical CVEs
  • Suggest updates for vulnerable packages

User responsibilities:

  • Keep dependencies updated
  • Review security advisories
  • Avoid deprecated packages
  • Audit third-party packages

Code review

Recommended for sensitive Projects:

  • Peer review before deployment
  • Automated security scanning
  • Manual audit of high-risk components

Vulnerability management

Responsible disclosure

Found a security issue? We appreciate responsible disclosure.

Reporting:

  • Email: security@triform.ai
  • Include detailed description
  • Steps to reproduce (if applicable)
  • Potential impact assessment

Our commitment:

  • Acknowledge within 24 hours
  • Triage and investigate promptly
  • Keep you informed of progress
  • Credit you in our security updates (unless anonymous)

Please don't:

  • Publicly disclose before we've patched
  • Exploit the vulnerability
  • Access other users' data

Security updates

Communication:

  • Critical issues: Email all users immediately
  • High severity: Status page + email within 24 hours
  • Medium/low: Included in regular updates

Patching:

  • Critical vulnerabilities: Emergency patch within hours
  • High severity: Patch within 7 days
  • Medium/low: Patch in next regular release

Infrastructure monitoring

Enhanced observability

Recent infrastructure improvements provide better security monitoring:

  • Kubernetes Promtail — Comprehensive log aggregation with label extraction and pipeline processing
  • Secure credential management — 1Password integration for automated, secure environment variable handling
  • Better deployment security — Automated dependency checks and secure secrets management

These improvements enhance our ability to detect, investigate, and respond to security events in real-time.

Incident response

Detection

Monitoring systems:

  • Failed authentication attempts
  • Unusual API usage patterns
  • Data exfiltration attempts
  • Privilege escalation attempts
  • Real-time log aggregation — Kubernetes-based monitoring for immediate anomaly detection

Alerts trigger: Automated response + human investigation

Response process

  1. Detect & triage — Identify and assess severity
  2. Contain — Limit impact, isolate affected systems
  3. Investigate — Determine root cause and scope
  4. Remediate — Fix vulnerability, restore service
  5. Communicate — Inform affected users
  6. Learn — Post-mortem, improve processes

User notification

We notify if:

  • Data breach occurs
  • Unauthorized access detected
  • Service compromise affects your Projects

Notification includes:

  • What happened
  • What data was affected
  • What we've done
  • What you should do

User security responsibilities

Account security

Use strong passwords — If using email authentication

Monitor sessions — Review and revoke suspicious sessions

Keep email secure — Your account recovery method

API key security

Never commit keys to git — Use environment variables

Rotate keys regularly — Every 90 days recommended

Scope keys minimally — Only grant needed permissions

Revoke unused keys — Reduce attack surface

Code security

Validate inputs — Don't trust external data

Sanitize outputs — Prevent injection attacks

Review dependencies — Check for vulnerabilities

Keep secrets in Project Variables — Never hardcode

Organization security

Audit members regularly — Remove ex-employees

Follow least privilege — Grant minimum necessary permissions

Security features roadmap

Coming soon:

  • SSO/SAML support (Enterprise)
  • Advanced threat detection
  • Custom security policies
  • Bring Your Own Key (BYOK) encryption
  • Enhanced audit logging
  • Security compliance dashboards

Security resources

Contact

Security issues: security@triform.aiGeneral support: Join our Discord community

External resources

Questions?

If you have security questions or concerns:

  1. Review the security documentation
  2. Contact security@triform.ai
  3. For Enterprise, contact your account manager

Was this helpful?

Still need help? Ask the team