Learn SecurityTrackr.
Learn how to use SecurityTrackr effectively, connect it to the rest of your stack, and understand the principles we build on. Practical guides to the platform, integrations, and the decisions behind the product.
Platform
Getting the most out of SecurityTrackr day to day.
Quick start: your first observation
Describe what you found in plain words, let the AI draft the formal finding, then review and save. Here's the whole flow, what makes an observation good, and the few things not to do.
How risk scoring works: likelihood, impact, and the matrix
Every observation gets a Critical, High, Medium, Low, or Very Low rating from two inputs through a fixed matrix. Here are the likelihood and impact scales, the matrix itself, and why it's a hand-tuned lookup instead of multiplication.
After the finding: how risk treatment actually works
You've logged a finding and scored it. Now what? Most tools make you set a status by hand. We compute it: you record a decision (mitigate or accept) and your progress, and the status follows. Here's the whole flow, and why it's built so the status badge can never lie.
The risk you accepted last year: revisiting acceptance decisions
Accepting a risk is a decision with a shelf life, but most registers record it as permanent. Set a review cadence when you accept, get told when it lapses, and re-state the rationale rather than overwriting it — plus the one design decision behind it worth stealing.
Billing, plans, and why LINK.COM* is on your statement
Two plans, one dial (seats), and a payment company on your statement that isn't us. How Free and Pro differ, why a plan change locks until renewal, and what Stripe (selling through Link) does in the middle.
Bring your own AI key (BYOK): setup, models, and cost
Route generative AI through your own OpenAI, Anthropic, or Mistral account. You pay the provider directly, and that data is processed under their terms. Who BYOK is for, the guided setup, which model to pick, how to cap your spend, and how we keep the key safe.
Where your AI data goes: your provider, a DPA, and zero data retention
Three things decide where your AI data lives and who can keep it: which provider processes it, a data processing agreement, and zero data retention. Advanced AI defaults to Anthropic for the sharpest output under our DPA + ZDR agreement; choose Mistral when you also need EU residency, or OpenAI when GPT is your house standard. Here's what each safeguard does and how they stack.
Legacy and agentic integrations
Wiring other systems into SecurityTrackr, old and new: the versioned REST API for scripts, scanners and SIEM tooling, and MCP for agent clients that connect directly.
Integrating via the REST API
A practical guide to the versioned REST API: bearer-token authentication, duplicate-safe ingest, observation lifecycle, comments, relations, evidence files, and the OpenAPI spec and downloadable skills you hand to an integrator.
Connecting agents to SecurityTrackr via MCP
A provider-neutral walkthrough of connecting an MCP client to SecurityTrackr: the server URL, OAuth consent and scopes, the twenty-one tools available across register work and collaboration, and how to revoke access safely.
Connecting a SIEM or log management tool to SecurityTrackr
A practical walkthrough of feeding SecurityTrackr's audit trail into your own SIEM or log management platform: the SIEM-only token, OCSF 1.5.0 events, cursor-safe polling, backfill, and retention.
Wiring an agent into SecurityTrackr with skills
Create a token, download the skill, point your agent at it. The whole flow for giving a Claude or generic LLM agent the ability to preflight, review, finalize, and work findings: why it beats a markdown file, the skill files, durable AI jobs, idempotency, rate limits, and how to hand over a token without leaking it.
How we build
The engineering decisions behind SecurityTrackr, and patterns you can reuse in your own systems.
How we build with AI: architectural decisions ensuring security
Two calls shape every generative AI feature we ship: run the model statelessly so it never remembers your data, and build every prompt like a parameterised query so user input can't turn into instructions. Here's how, and how to do the same yourself.
Searching data you can't read: blind indexes over encrypted findings
Your findings are encrypted at rest, so the database only ever sees ciphertext, and you can't run LIKE over bytes you can't read. Here's how we search them anyway without storing a single plaintext word: a per-org blind index built from HMAC token hashes, and the pattern you can reuse.
Finding the duplicate that shares no words: hybrid semantic dedup and relation search
Two people file the same finding in different words, and keyword matching sees nothing. Here's the hybrid funnel that catches it over encrypted findings when semantic matching is enabled: a per-org blind index for exact terms, encrypted embeddings for meaning, and two AI agents that decide what's a duplicate and what's a genuine link.