Security

How Mainline protects the data that flows through it, the people who manage it, and the software you install.

Your data

You choose where your events live: on relays in your network, or in Mainline Cloud.

In your network: Self-hosted, or with Mainline Cloud's console-only option, relays store events on your servers or in your cloud account, for as long as you configure, and deliver them to the destinations you choose.
In Mainline Cloud: Fully hosted, your events are kept in your own storage, apart from every other customer's, encrypted in transit and at rest, for as long as you choose, and exported or deleted when you leave. Your hosted relays accept connections only from your sites' addresses, and plain syslog never crosses the internet.
What the console keeps: Configuration, health, the audit trail, sealed secrets and a short excerpt of recent detection matches: on your server, or in your own instance with Mainline Cloud. Search reads events where they're stored.
Masking before delivery: Sensitive values can be removed or masked on the relay, so they never reach a destination.
Air-gapped operation: When you run it yourself, licences are offline keys and nothing calls home. Updates arrive as signed files you carry in.

Cryptography you can name in a review.

FIPS 140-3 mode: Mainline uses the Go Cryptographic Module in FIPS 140-3 mode, on by default; a stricter FIPS-only mode is available.
TLS everywhere: Agents, relays and the console talk over TLS 1.2 or later, with enrolment tokens and per-relay credentials.
Your certificate, renewed: The console serves your certificate or one from Let's Encrypt. Before it moves to a new certificate authority, relays and agents are given it, so none is cut off.
Secrets and spools sealed: Credentials are encrypted at rest and referenced, not copied, into configuration; agents' spools and console backups are encrypted too.

The right people, with the right reach.

Single sign-on: SAML 2.0 or OIDC with Microsoft Entra ID, Okta or any other identity provider, or LDAP and Active Directory.
Two-factor sign-in: Codes from an authenticator app, which you can require of admins or of everyone, with recovery codes for a lost phone.
Password rules and lockout: Following NIST SP 800-63B: long passwords, never the username or one common in leaks; repeated failures lock an address and an account out.
Allowed address ranges: People and API tokens only from your offices or VPN; relays and agents aren't limited.
A sign-in notice: An authorised-use notice before sign-in, as NIST AC-8 and CJIS ask for.
Roles and approvals: Administrators, operators, auditors and viewers, each limited to the fleets you assign; changes can be made to need a second person.

Every change, provably.

Hash-chained trail: Each entry includes the hash of the one before, so a removed or altered entry shows. Verify it from the console or the command line.
Retention that keeps the proof: Remove old months when you choose: the removal is recorded in the trail itself, so verifying it still works.
Export and forward: Export the trail for an auditor, or forward it to your SIEM as it's written.

Less to trust, and proof of what runs.

Signed releases: Every release is signed with Mainline Labs' release key; mainctl verify-release checks every file before you install.
Signed configuration: Everything the console sends relays and agents is signed. They apply nothing whose signature doesn't check out, and keep their last configuration instead.
No third-party code libraries: Mainline is built on Go's standard library alone, so there are no outside packages to track for vulnerabilities. A CycloneDX SBOM ships with every release.
Rollback: The installer keeps the previous version; relays and agents return to it by themselves if a new version won't start.

Built not to lose data, or the console.

Relay groups: Up to five relays per group. If the active one stops, the one that copied the most takes over, repeating at most the last few seconds of deliveries.
A standby console: It copies the active console every few seconds, and takes over on request or when the active one stops answering.
Console backups: The console's whole state, encrypted with your passphrase, to Amazon S3, Google Cloud Storage, Azure Blob Storage or a folder.

We want to hear about it.

Security issues: Email security@mainlinelabs.io, as listed in our security.txt. Please include steps to reproduce and the version you tested.

A pilot runs on your own servers: pick a source that matters, a destination you use, and what success looks like. We'll help you set it up.