What a security buyer asks first

The application runs on infrastructure operated by Qavren Solutions LLC in Amazon Web Services, in the us-east-1 region in the United States. Exercise records — the timeline, the decisions, the checkpoints and the reports — are stored in a hosted PostgreSQL database, reached over TLS. The application servers hold no exercise data of their own.

That database is shared platform infrastructure across Qavren Solutions LLC's applications, and this product has its own schema and its own login role inside it. The role owns that schema and holds no grant on any other, so the separation between applications is enforced by Postgres privileges rather than by application code remembering to filter.

Separation between customers is a different mechanism, and you should know which one it is. Exercises from different organisations live in the same tables and are separated by organisation scoping in the API: every request carries an authenticated principal, and a session belonging to another organisation is unreachable. That is application-layer isolation, not row-level security in the database.

There is no inbound port on the application host. Ingress is a Cloudflare Tunnel: the connector dials outward to Cloudflare and forwards requests over an internal network, so the instance has no inbound rule but SSH and no public address to scan. TLS terminates at Cloudflare.

This is a single-region deployment on a single application instance. It is not multi-region, and there is no documented recovery-time objective to quote you. If your procurement requires one, say so and we will talk about what it would take rather than pretend one exists.

Which is why the acceptable-use rule is a rule and not advice: never put a real credential, a live production secret, real customer personal data or regulated data into an exercise. A tabletop does not need any of it. The room is deciding what it would do, not operating the systems.

Provider-side retention is governed by our contract with that provider, not by this system. Deleting an exercise here destroys our copy; it cannot reach into the provider's.

Two cheaper model calls sit alongside the main one — a summariser that compresses the running state, and a guard that checks a proposed move against the established facts. They see the same exercise material and go to the same provider. There is no separate destination to disclose.

The people playing CISO, IT lead, legal and comms do not sign up, do not set a password, and do not hand over an email address. The facilitator mints a signed link for each role and sends it however they normally would.

A join link is an HMAC-SHA256 token scoped to one session, one scenario role and one organisation, with an expiry — four hours by default. Presenting it gets the holder a guest identity for that session and nothing more. A link for a different session returns the same 404 a stranger gets, so a stale or forwarded link does not even reveal that a session exists.

A guest can read the participant view of the room and submit actions. Every facilitator route — the after-action report, the checkpoint list, minting another link, advancing the clock — answers 403. The participant view is also reduced: pending complications, proposed moves, the internal situation summary and the facilitator's steering directives are not in it.

This is a deliberate design decision rather than a missing feature, and it is why there is no per-seat price: most of the room will never log in twice.

Facilitators hold real accounts, authenticated by Keycloak against a realm dedicated to this product. Their role and organisation are read only from claims an administrator controls: roles from realm_access, and the organisation from an org_id attribute declared admin-editable in the realm's user profile. The fields an account holder can edit about themselves — name, email, username — are never read for authorisation, and self-registration is disabled. An account cannot promote itself.

Every route requires an authenticated caller, and exercises are scoped to the organisation that created them. A caller from another organisation gets 404, not 403: the existence of someone else's exercise is not something we confirm.

A signed-in user with no facilitator role is treated as a participant. They can act in a session and read the reduced state, and nothing else.

It narrates effects and stakeholder behaviour, never attacker technique. It describes what the room observes and what the people around them do — an administrator account nobody can account for, material that has left the company's control, a reporter with your name and a deadline. It does not produce attack instructions, tooling, commands or credential handling.

That rule is enforced in three places, not one:

• In the game master's own instructions, which state it as a constraint on every turn.
• In a schema validator that refuses to load a scenario pack whose text breaks it — a pack written like a red-team report does not ship, it fails at import.
• In a content classifier applied to the model's output. When the classifier declines a move, the turn falls back to the authored complication instead of shipping what the model wrote.

Nothing is deployed on your network. No agents, no traffic, no scanning, no credentials, no connection to your systems of any kind. This is a discussion-based exercise: the room talks, and the record of what it decided is the product. Whatever your architecture is, this product never sees it unless a participant types it.

Export. One request returns the entire record as a single JSON document: the state, the full timeline, the decision record, the control coverage and the gaps, the scores and the token totals. It is assembled deterministically and makes no model calls, so it costs nothing and returns the same document every time.

Deletion. One request destroys an exercise and returns an itemised receipt of what went: every checkpoint in the thread, the timeline events, the token counters, the registry row, and any Word or PDF report rendered on that server. The receipt is the artifact you hand back to whoever asked for the erasure. A session with what-if branches refuses to delete until you say to take the branches too, so a child cannot be orphaned silently.

Neither is ever gated by billing. Reading, exporting and deleting an exercise you have already run work on every tier and in every subscription status, including past due and cancelled. Locking a customer out of their own compliance evidence over an expired card is indefensible, and a deletion right cannot be conditioned on payment.

What a deletion cannot reach, stated plainly:

• Anything already sent to the model provider. That is governed by our contract with them, and nothing in this system can reach it.
• Copies you have already taken. A downloaded report or export is on your disk and stays there.
• Point-in-time database backups, which age out on their own schedule. A row deleted today is gone from the live database, not from yesterday's snapshot.

There is no automatic expiry. An exercise created today is still there in a year unless someone deletes it. For a compliance product that is the right default — evidence that silently vanished on a timer would be worse than useless to the auditor waiting for it — but it means retention is your operational policy, not something the platform enforces on your behalf. Your regime may put a floor under it that we do not enforce — 45 CFR 164.316(b)(2)(i), for one, requires six years from creation or from the date it was last in effect for the documentation the HIPAA Security Rule covers. An artifact that lives only inside this application is not a retention plan.

TTX Commander does not hold a SOC 2 report or an ISO 27001 certificate of its own. This page will say so until that stops being true. If a third-party attestation of the platform is a hard requirement for you, we are not there yet.

We are not an assessor of any kind. Not a QSA, an ISA or a PFI under PCI DSS; not a C3PAO or a registered practitioner under CMMC; not an accredited certification body for ISO/IEC 27001; not a CPA firm; not a law firm. None of the standards bodies, regulators or supervisory authorities named anywhere on this site has reviewed, endorsed or approved this product.

The product does not certify anything. It produces evidence of an exercise you can present. Whether a given auditor, assessor, supervisor or underwriter accepts a given report is their call, and any vendor telling you otherwise is selling you something they cannot deliver. Nothing on this site is legal advice — including the framework clauses we quote, which are quoted so you can go and read them, not so you can rely on our reading of them.

There is no penetration-test report, no bug-bounty programme and no trust portal to link to yet. When any of those exist they will be linked here rather than described here.