Privacy and security

This guide covers what is protected and what your organisation controls.

Your data

Your cases are visible to the analysts of your organisation.
Maelstrom AI staff open a case only to give support, or to investigate abuse or a security incident. We will give you written notice promptly when we open a case to investigate, unless the law or the investigation forbids it.
A case id from another organisation returns "not found".
The case page, the reports, the case ZIP and the API show indicators defanged. Copy raw, Copy for blocklist, hunt searches and the raw network log hold original values. Before livewells copies raw values, it asks you.
livewells does not sell your content.

Threat data

When an analyst of your organisation sets a case to malicious, livewells can keep a de-identified record of it.

The record holds attacker indicators, page structure, counts from enrichment and the verdict label, with recipient identifiers removed.
The record has no field for your organisation or your analysts, and livewells does not keep a record that still holds your organisation's domains or identifiers.
Video is never part of the record.
An administrator can exclude all cases. The analyst who ran a case, or an administrator, can exclude one case.
livewells uses no excluded case, and deletes any record it already kept from an excluded case.

Organisation separation

Your Entra organisation picks your livewells organisation. The email address only routes you to the right sign-in.
Each organisation's cases are stored apart from every other organisation's, and stored files sit under your organisation's own path.
Each session runs in its own disposable container, which livewells destroys when the session ends.
The container never receives your sign-in token or cookies.
Operators from Maelstrom AI see no links, reports or videos in the operator console.
Every operator action on your organisation is written to your audit log, with the operator's identity.

Sign-in uses Microsoft Entra ID, and follows your organisation's own Entra policy, including multi-factor sign-in.
A session lasts up to 8 hours and ends after 30 minutes without use.
A person holds up to 10 sessions at once in an organisation. A new sign-in beyond that ends the oldest.
Your organisation can require multi-factor sign-in. livewells then lets in only a token that proves it.
Sign-out ends the session and clears what the browser stored for livewells.
Sign-ins and sign-outs are written to your audit log. A sign-in entry records whether it used multi-factor and the time the person last signed in at Microsoft.
livewells keeps the email of each person who signs in, for the People list, until a year after their last sign-in or until the organisation's data is deleted.

The disposable browser

The disposable browser reaches the web through an Australian exit address from our network provider. livewells looks up the country of each exit address and reuses the answer for 24 hours. It stops using an address that the lookup places outside Australia.
A network provider supplies the connections of the disposable browser. It receives the network traffic of the pages that a case opens. It receives no account data.
livewells refuses connections from the disposable browser to private networks, loopback addresses and cloud metadata addresses.
A session ends after 15 minutes at most.
A session ends a few seconds after the page makes 100 page changes, or sends the browser to 60 different sites. The browser keeps at most 10 open tabs and livewells closes the extra ones. A session also ends when the page changes its own address 300 times without loading a new page.
One session can move 256 MiB through its connection. One downloaded file can be 64 MiB. When a session or a download reaches its limit, the connection ends and the case says so. livewells captures a downloaded file of up to 25 MiB and checks it. See Captured downloads.
When no connection is free, the session does not start and the run is not counted. The browser does not fall back to a direct connection.

Stored data

For each case, livewells stores the link you submitted, the video, the report, the network log, session details, enrichment, the verdict and audit entries. For a file, livewells stores the file, its report and its page pictures. The retention period applies to them.

The signed-in app asks the server for the email address of the person who signed in each time a page loads, and the header shows it. Sign out clears at once what the tab remembered, and the browser deletes the rest when the tab closes.

Retention and deletion

The default retention is 90 days. An administrator can set 7 to 365 days.
livewells deletes cases older than the retention period every day.
An administrator can delete a case sooner through the API.

Data location

livewells asks Cloudflare to store Customer Content in Oceania using a location hint. A hint is a request, not a guarantee.
livewells does not set a location for session containers. The session containers run on Cloudflare Containers, and Cloudflare chooses where each one runs.

If Australian residency is a hard requirement, tell us before you sign up.

Sub-processors

Cloudflare (hosting, storage, containers), a network provider (the connections of the disposable browser) and Stripe (billing). Microsoft Entra ID is your identity provider for sign-in. A threat intelligence provider receives IP addresses and domains (host names) from a case's network record, to check their reputation. The provider receives one value for each request and nothing else from the case. The sub-processor list names it.

Reporting a problem

Tell Maelstrom AI if you think a key or a session has leaked. You can revoke keys yourself under API keys and webhooks.