What the product is held to
Self-hosted first
Your threat data is some of the most sensitive data you have. It lives in your Postgres, in your VPC, on your terms. We never see it — architecturally, not contractually.
No telemetry, ever
The product doesn't phone home. No usage analytics, no crash reporting to us, no quiet metadata. The only outbound call is the LLM you configure — and you can keep even that in-house.
Agents for the boring half
AI in CTP247 does the work analysts shouldn't burn hours on: reading feeds, triaging entries, enriching IOCs, drafting takedowns. The judgment calls stay human — the agent asks before anything leaves the building.
Evidence over claims
Every alert carries its source, every agent decision its reasoning, every takedown its evidence pack. If the platform asserts something, you can click through to why.
Standards, not lock-in
STIX, TAXII 2.1, MITRE ATT&CK, plain Postgres. The day you want to leave, your data is already in formats the rest of the industry reads. We'd rather keep you with the product than with the export barrier.
Talk to the people who build it.
Demos are run by the team that writes the code. Questions about security posture, deployment, disclosures, or legal all land in the same inbox — the one we read every day.