LIVE AZURE SCAN EVIDENCE
Real healthcare Azure environment scanned April 15, 2026. Per-resource evidence showing WHY each resource was flagged, which HIPAA/compliance rule it broke, and the exact remediation.
| DATA CATEGORY | EXAMPLES | USED FOR |
|---|---|---|
| Resource Inventory | VMs, Storage, SQL, Key Vault, NSGs, App Services, Disks | Infrastructure health and cost analysis |
| Security Configurations | NSG rules, firewall settings, encryption status, TLS versions | Vulnerability detection and hardening |
| IAM / RBAC | Role assignments, service principals, managed identities | Access control and privilege analysis |
| Network Topology | Subnets, peering, public IPs, load balancers, DNS | Attack surface mapping |
| Compliance Posture | Policy assignments, diagnostic settings, audit logs | Framework compliance mapping |
| Cost & Usage | Spending data, resource utilization, idle resources | Cost optimization and waste detection |
All data transmitted between your browser and TITAN AI is encrypted with TLS 1.3 using AES-128-GCM with post-quantum key exchange (X25519MLKEM768). TLS 1.2 is supported as fallback — TLS 1.0 and 1.1 are disabled.
All scan reports, findings, and customer data stored on Azure are encrypted at rest using AES-256 bit encryption via Azure Storage Service Encryption (SSE). Encryption keys are managed by Azure Key Vault with HSM backing.
TITAN AI operates on a zero-trust model. Every API call is authenticated, every session is verified, and every agent runs with least-privilege access to your Azure environment. Read-only by default — no implicit trust.
All HTTP traffic is automatically redirected to HTTPS. HSTS (HTTP Strict Transport Security) is enabled with a 1-year max-age, includeSubDomains, and preload directives. SSL certificate via Let's Encrypt with auto-renewal.
| HEADER | VALUE | PROTECTION |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | Forces HTTPS for 1 year — prevents downgrade attacks |
| X-Frame-Options | DENY | Prevents clickjacking — blocks iframe embedding |
| X-Content-Type-Options | nosniff | Prevents MIME type sniffing attacks |
| Content-Security-Policy | default-src 'self'; script-src 'self' ... | Prevents XSS and code injection attacks |
| Referrer-Policy | strict-origin-when-cross-origin | Controls referrer header leakage |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Disables unnecessary browser APIs |
| X-XSS-Protection | 1; mode=block | Legacy XSS filter — blocks reflected XSS |
TITAN SCOUT and SENTINEL operate with Azure's built-in Reader RBAC role. They scan and analyze without modifying any resources. Only TITAN FORGE writes changes — and only with explicit approval and preview.
No credentials stored in code. TITAN AI uses Azure Managed Identity or Service Principal authentication with certificate-based auth — your credentials never leave your Azure tenant.
TITAN FORGE previews every fix before applying it. Each remediation is logged, reversible, and validated with a re-scan. No blind changes — ever. You approve before anything is modified.
Every scan, finding, remediation, and API call is logged with timestamps, user context, and result data. Complete audit trail for compliance reviews, incident response, and regulatory exams.
We provide a GDPR-compliant Data Processing Agreement to all customers upon request. Our DPA defines data controller/processor responsibilities, data handling obligations, and breach notification procedures.
We maintain a public list of sub-processors who handle customer data. Current sub-processors: Microsoft Azure (infrastructure hosting), Stripe (payment processing), AI Analysis Engine (report generation). No other third parties receive your data.
Scan data and reports: 12 months, then auto-deleted. Account info: 90 days post-cancellation. Billing records: 7 years (tax compliance). You can request early deletion at any time via email.
All customer data is processed and stored on Microsoft Azure infrastructure in the United States (East US region). For customers with data sovereignty requirements, regional deployment options are available upon request.
Azure Resource Discovery & Attack Surface Mapping
Data accessed: Azure Resource Manager metadata only (resource types, tags, locations). Read-only ARM API.
PHI: None
Vulnerability Scanning & Threat Detection
Data accessed: NSG rules, TLS configs, port exposures, CVE matching. No customer data.
PHI: None
Shadow IT & Data Exfiltration Detection
Data accessed: Azure activity logs, sign-in logs, resource access patterns. Metadata only (filenames, sizes).
PHI: Metadata only — filenames not contents
Auto-Remediation (Preview Mode Default)
Data accessed: ARM write API for config changes only. No user-data access. Preview mode by default.
PHI: None
Compliance Framework Mapping (16+ frameworks)
Data accessed: Findings from other agents only — no direct cloud data access.
PHI: None
Continuous Monitoring & Alerting
Data accessed: Azure Monitor metrics, alerts, Log Analytics queries (metadata).
PHI: None
Audit Evidence Collection & Report Generation
Data accessed: Control evidence from other agents. Generates DOCX/PDF reports for auditors.
PHI: None — evidence metadata only
Member Risk Scoring & Engagement
Data accessed: Member demographics, claims summary, care gap indicators.
PHI: YES — BAA REQUIRED
Clinical Call QA & HIPAA Compliance Checks
Data accessed: Call transcripts, agent scripts, QA scorecards. Encryption in transit and at rest.
PHI: YES — BAA REQUIRED
Member Outreach Optimization
Data accessed: Outreach logs, contact preferences, response rates. Limited PHI (contact data only).
PHI: Limited — BAA required for contact data
ER Visit & Readmission Prediction
Data accessed: Clinical history, diagnoses (ICD-10), lab results, medication lists.
PHI: YES — BAA REQUIRED
Anti-Money Laundering Alert Triage
Data accessed: Transaction metadata, customer risk scores, SAR filings.
PHI: No (NPI under GLBA 16 CFR 314)
Real-Time Transaction Fraud Detection
Data accessed: Transaction patterns, device fingerprints, geo-velocity.
PHI: No (NPI under GLBA)
Customer Identification & Screening
Data accessed: Identity documents, PEP/sanctions/watchlist databases.
PHI: No (NPI under GLBA)
TCPA / CPNI Compliance Auditing
Data accessed: Call/SMS consent records, CPNI logs, FCC filings.
PHI: No (CPNI under 47 CFR Part 64)
Data Pipeline & ETL Quality Monitoring
Data accessed: Pipeline metadata, row counts, schema validations — no row-level data.
PHI: None
Third-party white-box penetration testing performed annually by an independent security firm. Covers web application, API, infrastructure, and authentication testing. Summary report available under NDA.
Automated vulnerability scanning runs continuously on our infrastructure. SAST (static analysis) on every code commit. Dependency scanning for third-party library vulnerabilities. Critical findings remediated within 24 hours.
All code goes through peer review, automated testing, and security scanning before deployment. Secrets scanning on every commit. No credentials in source code — all secrets managed via Azure Key Vault.
Get a FREE read-only security audit of your Azure environment. Zero risk. Full report. Agentless.
