trustops-security-data-lake 0.2.11

For a source install without uv:

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev,server]"
make web-install web-build
security-lakehouse fixtures load --company golden --out build/lakehouse
security-lakehouse db upgrade --lake build/lakehouse
security-lakehouse serve --lake build/lakehouse --server --allow-insecure-no-auth --port 8787

For the CLI and local lake only:

pip install trustops-security-data-lake
security-lakehouse fixtures load --company golden --out ./lake

Docker, Helm, and production configuration · Server authentication

Identity & access · data protection · detection · logging · change management · availability · incident response · third-party risk · vulnerability management · AI governance · risk management · privacy · governance · monitoring · control operations.

One safeguard can serve several frameworks. Every required mapped safeguard must pass for a requirement to pass; an unmapped requirement remains unmapped. A reviewed mapping is not certification or proof that a customer's controls pass.

CCF design and safeguards · Coverage by framework · Executable catalog

security-lakehouse frameworks safeguards --format table

The images below show the stored demo fixture, not live customer evidence.

Overview	Evidence

Full walkthrough · Connectors · Frameworks · Findings · Triage · Remediation · Audit room · Workflows

In the console, open Connectors → choose a source → Discover → Test → Enable → Sync. No pre-existing data lake is required. For automation, use the headless setup playbook.

Sources include AWS, Azure, GCP, GitHub, GitLab, Okta, Snowflake, and ClickHouse. Check the connector catalog for each integration's scope and status.

No connector requires pasted long-lived cloud keys.

• AWS uses STS AssumeRole, one External ID per deployed role, short-lived session credentials, and read-only IAM posture APIs. Temporary credentials expire after each session; TrustOps stores no long-lived access keys. Scale rollout with CloudFormation StackSets or Terraform workspaces; Bulk account import is the next operator surface. See the cloud setup guide.
• Azure supports a customer-owned Entra application, managed identity, or federated workload identity with Reader scope.
• Snowflake uses a read-only service identity with a key-pair or OAuth token reference. TrustOps stores identifiers, not passwords or private-key contents. Snowflake is the existing security-data-lake path.

AWS credential lifecycle diagram · Continuous ingestion

Catalog size, mapped coverage, and evaluated results are separate measures. Inspect the current safeguard catalog with security-lakehouse frameworks safeguards.

Source → Raw evidence → Normalized facts → Control evaluation → Assessment
                                                ↓                  ↓
                                           Owned findings    Review / export

Run locally with Python or Docker, or deploy the Helm chart in your own cloud. The current assessment writer needs durable local POSIX storage and one writer per lake. Snowflake and ClickHouse integrations are evidence backends; they do not host the TrustOps application. Snowflake Native App packaging and Databricks support are planned. See the deployment guide.

Architecture guide · Architecture diagram · Assessment publication and failure contracts

TrustOps operator skill · Specialist skills · Agent workflow catalog · AI bill of materials

make smoke       # backend, contracts, docs, brand, pipeline, API
make web-ci      # install, typecheck, production build
make security    # dependency audits and pre-commit checks

Regenerate fixture screenshots with make demo-screenshots-full.

Validation and benchmark plan · Deployment · Roadmap · Third-party assets