Security and compliance

The product’s own security

Thulpar stands in front of the organisation’s most sensitive traffic, so its own security posture is part of the product: where it connects, what it stores, how it proves who it is and the defaults it ships with.

Zero egress

No telemetry, licence ping, remote generation or crash report. The one outbound connection is model download, only when the host explicitly allows it, an administrator picks a model in the panel, and only to allow-listed hosts. The no-egress gate in CI verifies on every PR that the product source carries no telemetry SDK or model-vendor host.

Supply chain

Every image is built on native runners for amd64 and arm64, published to GHCR by digest, carries an SBOM per architecture and is signed keyless with cosign. Third-party images come from the vendor’s mirror with byte-identical digests. Every checksum file is signed; the kit verifies its own signature.

Licence

An Ed25519-signed document; the verification keys compiled into the image; signing in a single reviewer-gated workflow. Clock rollback is refused; transaction metering is chained into the ledger; the document may bind to the installation id.

Identity

The organisation’s OIDC provider for people; local accounts + TOTP as break-glass. Tenant-bound keys for callers, authenticated from the headers before the body is read. SPIFFE SVIDs for workloads; optional mTLS api → detectors; XFCC only from named proxies.

Safe defaults

Production-safe templates, every secret generated, a one-time bootstrap token, no session before the first administrator. Security rails closed; the sector templates’ critical rails locked. Tenant isolation on every table; a foreign row is 404.

Isolation

File analysis in a separate child process per file with memory and time limits; YARA’s format modules only there; Semgrep in its own process group without network; the detector sidecar optionally under gVisor. Containers with a read-only root, non-root, capabilities dropped.

Logs and data

No raw content in logs: pino redacts; the ledger stores hashes instead of content; the redacted sample is at most 2 KB and deleted at the end of retention. Unless a tenant pack opts in, no prompt is written to disk in plain text.

The GR-* control catalogue

The catalogue has 26 controls in 19 families (injection, tool calls, information flow, exfiltration, personal data, system prompt, output, execution, identity, tenant isolation, memory, agent to agent, resource limits, content, transparency, logging, red team, incident, governance). It is generated from the product’s own code: the same table the evidence packs are written from.

• Every control carries the rails and built-in features that implement it (ledger, approvals, signing, export, red team), its OWASP LLM / Agentic / MCP and MITRE ATLAS counterparts and seven regulation columns.
• Every finding carries a control id; the console and the evidence pack lead from the finding to the control and from the control to the article.

Evidence packs

An evidence pack is a signed ZIP per tenant, period and profile that answers the auditor’s question: which policy version, which detector, which decision. It is requested from the console or the API, written to a local volume or an S3-compatible store, and can be scheduled. The auditor verifies it with the installation’s public key, without internet.

Regulatory crosswalk

Red team

Nine suites run with the Turkish pack, promptfoo, PyRIT and garak against the check API (every stage), the gateway or a customer endpoint; they measure the attack success rate per category and the over-refusal rate on benign samples. Results are written to the ledger as benchmark events bound to a policy version; the console shows drift. The nightly run executes and publishes every suite.

• Gates: GR-RT-01 direct ASR at most 5 %, indirect at most 10 %, tool abuse and exfiltration 0 %; GR-INJ-03 over-refusal at most 3 % Turkish, 5 % English; error rate at most 5 %.
• The activation block: a pack that sets policy.requireBenchmark cannot activate without a published run whose gates passed. Publishing needs a redteam-scoped key only a SUPER_ADMIN mints.
• A detector that blocks benign Turkish text counts as a regression; the over-refusal rate is a CI gate.

Retention and deletion

The hash chain stays; the content goes. Redacted samples are deleted at the end of the effective pack’s retention without touching the chain and a purge event is written; events, hashes and sample references stay and the chain verifies unchanged. Retention is set in the tenant pack and cannot fall below an installation-wide floor: KVKK Art. 7 requirements together with the sector floors (BDDK and public sector 5 years, defence 10 years).

• Tenant offboarding is one command and cannot be undone: the tenant disabled, API keys revoked, every redacted sample and approval note erased at once whatever the retention says, a purge event and an anchor right after it, the whole chain verified.
• The output is a certificate of deletion signed with the installation’s signer key: installation and tenant id, when and by whom, the actions taken, the hashes of the purge event and the anchor, what remains (content-free events, earlier evidence packs and backups); a statement in Turkish and English.
• The final export first: evidence packs for the tenant’s whole period and the raw event list, handed over with the signer key’s public half through separate channels.

thulpar-admin offboard tnt_acme --confirm tnt_acme > deletion-tnt_acme.json
# tenant disabled · 4 keys revoked · 12 840 samples and 37 approval notes erased
# purge evt_01J… · anchor anc_01J… (root 9f3c…) · chain verified · certificate signed

Vulnerability disclosure and disclaimer

If you find a vulnerability, write to security@thulpar.com; ask for an encrypted channel when the report is sensitive. We answer within 72 hours and support coordinated disclosure. Include the version, the install profile and method, what an attacker needs, the steps and the impact; never send real personal data or a customer’s content. A bypass of a control the product promises (a closed rail letting content through, a licence or tenant boundary crossed, the chain altered undetected, egress at run time) is at least high severity.