Talos ingests telemetry from tens of thousands of machines. We treat that data the way our customers treat their equipment — carefully, with a paper trail, and with someone on call when it counts.
In transit and at rest, with modern ciphers and short-lived credentials for every service-to-service call.
Least privilege by default. Engineers get the access their job needs — and no more, checked quarterly.
Primary data storage stays in the EU. No customer data leaves the region without an explicit contractual basis.
You can't protect what you can't see. Every service emits logs, metrics and traces — and gets tested backups.
| Area | Talos today |
|---|---|
| Data hosting | Microsoft Azure, Western Europe (Amsterdam) primary, North Europe (Dublin) failover. |
| Encryption in transit | TLS 1.3, HSTS preloaded, modern cipher suites only. |
| Encryption at rest | AES-256 for databases, object storage, backups and disks. |
| Authentication | SSO (SAML / OIDC) for enterprise; password + MFA for standard accounts. |
| Authorisation | Role-based access with per-tenant scoping and row-level security in the database. |
| Audit logging | Immutable audit trail for authentication, permission changes and data exports. |
| Backups | Daily encrypted backups, 30-day retention, point-in-time recovery. |
| Uptime target | 99.9% monthly for the production API and web app. Public status page available on request. |
| Incident response | 24/7 on-call, ≤ 15 min acknowledgement for Sev-1, customer comms within 24h. |
| Vulnerability management | Continuous dependency scanning, quarterly external pen-test, annual review of security controls. |
| Personnel | Background checks on hire, security training on onboarding and annually, signed confidentiality agreements. |
| Data deletion | On contract end, customer data deleted within 30 days from live systems and 90 days from backups. |
We're honest about what's certified today and what's on the roadmap. You can see the same status here that we share in our security questionnaires.
We act as processor for customer telematics data. DPA available on request or via the site.
Information Security Management System scoping complete. External audit targeted for H2 2026.
Controls mapped; observation window planned for 2027 once ISO 27001 is certified.
Data portability APIs and machine-generated data access flows reviewed against the EU Data Act.
Incident reporting, supply-chain security and governance mapped against NIS2 obligations.
The infrastructure and service providers that process customer data on our behalf are listed in the Data Processing Agreement, with location and purpose for each.
Read the DPAWe welcome reports from security researchers. If you've found a vulnerability in Talos, email security@talos.be with a description, reproduction steps, and any impact you can demonstrate.
Access data that isn't yours, run automated scans that could disrupt service, or publish findings before we've had a chance to fix them.
We use essential cookies to keep the site working, and optional analytics cookies to understand what's useful. You choose. Learn more.
