logo

Security at Lockbase Cyber

Last reviewed: October 30, 2026

Lockbase Cyber helps organizations run Microsoft Security as a working operational capability, and we apply the same discipline to our own environment. This page describes how we protect customer data and the systems we use to deliver our consulting services and our two SaaS products, Huntstack and Drift Control for Identity.

This page summarizes our practices. Your organization’s agreement with Lockbase describes our contractual security commitments, and this page does not amend that agreement.

Security program

Lockbase runs one information security program, the Lockbase Security & Trust Program, established by a written charter and governed by management. The program uses the NIST Cybersecurity Framework 2.0 for governance and NIST SP 800-53 Rev. 5 as its control reference.

The program is defined in a library of approved policies covering information security, roles and responsibilities, risk management, access control, cryptography, secure development, change management, operations security, incident response, business continuity and disaster recovery, data management, asset management, third-party management, human resource security, physical security, and a code of conduct. Each policy has a named owner and is reviewed at least annually and when our systems, services, or obligations change. We track risks, exceptions, and corrective actions in a risk register that management reviews on a regular cadence.

Compliance

Lockbase is pursuing a SOC 2 Type 2 examination covering the Security and Confidentiality trust services criteria for Huntstack and Drift Control for Identity. ISO/IEC 27001 certification is planned to follow. We will update this page as reports and certificates are issued.

Until then, we respond to security questionnaires and can share additional detail about our controls under a nondisclosure agreement. The cloud providers we rely on, including Microsoft, maintain their own independent audit reports, which we review as part of vendor management.

Where our services run

Lockbase is a remote-only company. We do not operate offices, data centers, or server rooms.

  • Huntstack runs on Microsoft Azure in the United States. Traffic to the service passes through Cloudflare, which provides a web application firewall and protection against automated traffic.
  • Drift Control for Identity runs on Microsoft Azure in the United States, with its database hosted on Neo4j AuraDB, which runs on Microsoft Azure in the United States. Each customer organization has a separate database.
  • Internal business systems run on Microsoft 365 and Microsoft Azure.

Physical security of hosting facilities is the responsibility of these providers and is covered by their independent audit reports.

Encryption

  • In transit. Customer data is encrypted in transit using TLS 1.2 or higher, with TLS 1.3 used where both ends support it. Endpoints whose TLS configuration we control do not accept older protocol versions.
  • At rest. Customer data stored by our products is encrypted at rest with AES-256, using encryption managed by the hosting platform. Backups are encrypted at rest.
  • Keys and secrets. Keys, secrets, and certificates are kept in approved stores such as Azure Key Vault, never in source code. They have named owners and are rotated on a defined schedule and immediately on suspected exposure. Lockbase does not currently offer customer-managed encryption keys.
  • Laptops. Company-managed laptops use full-disk encryption enforced through Microsoft Intune.

Access control

  • Workforce identity. Lockbase personnel sign in through Microsoft Entra ID. Multifactor authentication is required for cloud, administrative, production, and customer-environment access, and legacy authentication protocols are disabled.
  • Least privilege. Access is granted only for a defined business purpose. Administrative roles are activated on a time-limited basis with multifactor authentication rather than held permanently. The only standing administrator account is a single emergency access account, which is protected with a hardware security key and alerts on every sign-in.
  • Reviews and removal. Privileged, production, and customer-environment access is reviewed quarterly. Access is removed promptly when a person’s role changes or they leave Lockbase.
  • Product sign-in. Huntstack users sign in through Microsoft Entra External ID. Drift Control users sign in with their own organization’s Microsoft Entra ID. Lockbase does not store user passwords for either product.
  • Access to your Microsoft environment. Our products reach a customer’s Microsoft environment only through consent and permissions that the customer grants and can revoke. Drift Control’s access is read-only. Huntstack connects without storing passwords or secrets for the customer’s tenant.
  • Staff access to product data. Lockbase staff access customer information in our products only to provide support the customer requests or to operate and secure the service.
  • Consulting engagements. Our access to a customer’s environment is authorized by the engagement, limited to the scope and period it requires, protected by multifactor authentication, and removed when the engagement ends.

Secure development and change management

  • Reviewed changes. Product code changes are made through pull requests on protected branches and require approval from a person other than the author before they merge.
  • Automated checks. Pull requests are checked for vulnerable dependencies and exposed secrets.
  • Change control. Changes to production systems are classified by risk and recorded. Higher-risk changes, including changes to authentication, customer-data flows, or encryption, receive a security design review before release.
  • Artificial intelligence. Neither Huntstack nor Drift Control sends customer data to an AI model operated by Lockbase, and customer data is not used to build our content or to train any model.

Vulnerability management and monitoring

  • Scanning. We run automated vulnerability scanning across company-managed devices, Azure resources, container images, and internet-facing services using Microsoft Defender. Findings are reviewed at least monthly and remediated within defined timelines based on severity, with critical issues prioritized.
  • Endpoint protection. Company-managed devices are managed through Microsoft Intune and protected by Microsoft Defender for Endpoint.
  • Logging. We log sign-ins, privileged activity, administrative actions, and production changes in the systems we operate, where the platform supports it, and use those logs for investigation and access review.
  • Operations review. Each month we review scan coverage, findings, monitoring, and backup status, and track any gaps to closure.

Incident response

Lockbase maintains an approved incident response plan with defined roles, severity levels, evidence handling, and communication steps. The plan is exercised through an annual tabletop exercise.

If a security incident affects customer data, we notify affected customers without undue delay and within the timeframe set in their agreement. Significant incidents receive a documented post-incident review, and corrective actions are tracked to completion.

Business continuity and data handling

  • Continuity. Lockbase maintains a business continuity and disaster recovery plan that sets recovery priorities for our products and internal operations. The plan is reviewed at least annually.
  • Backups. Product databases are backed up through their hosting platforms.
  • Classification. Information is classified, and customer data is handled as confidential.
  • Retention and deletion. Customer data is retained and deleted as described in each product’s privacy notice and the customer’s agreement.

People

  • Screening. Personnel are screened according to their role and applicable law before they receive access to systems or confidential information.
  • Agreements. Personnel sign confidentiality agreements and acknowledge our security policies before receiving access.
  • Training. Personnel complete security awareness training within 30 days of starting and at least annually after that, covering phishing, credential protection, and incident reporting.

Vendors and subprocessors

We assess vendors before use, classify them by risk, and review critical vendors at least annually. Subprocessors that handle customer data are bound by written security obligations. Each product’s subprocessors are listed in its privacy notice, and we give customers at least 30 days’ notice before adding a subprocessor that processes customer data.

Reporting a security concern

To report a vulnerability or security concern, email security@lockbasecyber.com. We acknowledge reports within one business day. Please include enough detail for us to reproduce the issue, avoid accessing or changing data that does not belong to you, and give us reasonable time to investigate before sharing the issue publicly.

No system is completely secure, and Lockbase cannot guarantee the security of any information. Our practices may change as our services evolve, provided we do not materially reduce the overall level of protection for customer data.

Questions about this page: security@lockbasecyber.com

chevron-down