Security and data flows

Isolation

• One stack per organisation. No container, database, certificate or credential is shared with another customer's stack.
• Every password, key, token and certificate authority is generated on your server by the install. None is built into an image.
• Internal services have no host port; only the gateway (443, 80) and the Wazuh manager (1514) are published, plus, on a two-server core, four ports on the private address for the application server.

What leaves your network

Self-hosted

Data	Goes to	When
Stack health (service states, probe results), version, and the agent list (names, addresses, OS, status)	Theseus control plane	Every 5 minutes and after each change
Install progress, step output (passwords masked)	Theseus control plane	During installs
Generated secrets and the stack's CA	Theseus control plane, sealed	Once, when the core or single server finishes its install, so that a second server or a re-install can use them
The first administrator's password	Nowhere: shown in your terminal and kept in FIRST-LOGIN.txt
Alerts, events, vulnerabilities, inventory	Not sent to the control plane
Questions and the data Pallas reads	Your LLM endpoint	When Pallas or AI features are used
Vendor API calls	AWS, Cloudflare, Microsoft, Sophos	When configured
Vulnerability feed downloads	NVD, Microsoft, Canonical, CISA, Wazuh	Regularly; requests, no customer data

The configuration we manage for you (including integration secrets such as an AWS key you give us) is held by the control plane and sent to your server inside a signed job.

Hosted by us

The stack runs on our infrastructure, so all its data is there, isolated per customer. Endpoints send their events to it over TLS. We keep the first administrator's sign-in sealed until we hand it over.

Optional hosted services coming soon

With hosted Pallas or hosted patching (not available yet), the alert, inventory and vulnerability data those services read would leave your infrastructure for ours.

Credentials

Credential	Where it lives
Service passwords and keys	theseus.env (mode 0600) and runtime/ (directory 0700) on the server
Internal CA and certificates	runtime/pki/; runtime/pki/extra-ca.pem (optional) is a CA you add to the services' trust bundle
Patch job-signing key	runtime/pki/agent/jobs.key; endpoints pin its public half at enrolment
Vendor connector credentials	runtime/connectors/<name>.json
Cloudflare credentials saved in the console	The console database, encrypted
User passwords	Keycloak's database
Enrolment tokens	Only a SHA-256 hash; the token is shown once

Services use least-privilege accounts towards each other: the enrolment service's Wazuh API account can only register, read and delete agents and assign groups; console services use an indexer account without security administration.

Endpoints

• Wazuh agent registration never ships a shared password. The registration port (1515) is not published; agents are registered by the enrolment service through the manager API.
• Package signatures are checked: Wazuh's repository key (Linux), Authenticode (Windows), Developer ID (macOS).
• The Theseus agent connects out only; endpoints open no port. Each request is signed with the machine's own Ed25519 key, created on the machine; only its public half leaves it. Requests must be fresh and their nonce unseen.
• Jobs are signed by your stack's job key, pinned at enrolment. The agent runs a job only if it verifies, names this machine and has not expired. Jobs name one of a fixed set of actions (exact package versions, Windows KBs, Homebrew, reviewed winget and pip helpers, reboot, Wazuh agent restart, stop, start, uninstall). There is no shell and no "run command" action.
• Revocation: removing a machine revokes its enrolment; its next request is refused.

theseus-node

• Outbound HTTPS only; it pins the control plane's TLS key.
• Requests signed with its own Ed25519 key; jobs signed by the control plane and refused when the signature, target node, time or job id is wrong. Each job id runs once.
• A fixed list of jobs, each running ./theseus with fixed arguments; no "run command" job, and no values interpolated into command lines.

Sign-in

Keycloak (realm athena-security) for the console, Pallas and the Wazuh dashboard. Password policy: 12 characters minimum, upper case, lower case, digit, special character, not the username or e-mail. Page access per role; changes are recorded in the audit log.

Known limits

• The Wazuh manager API's certificate is issued by the manager itself and is not yet pinned by the services that call it (on the internal network).
• Internal service-to-service authentication uses static generated keys, one per pair of services.