> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Compliance Owner

> The security owner's course for Thread: how security tickets flow, how Thread handles data and permissions, and Skill Library runbooks for SOC and audits.

export const ByRoleProgress = () => {
  useEffect(() => {
    const KEY = "thread-onboarding-completed";
    const TEAL = "#00B398";
    const BASE = "/start-here/roles/";
    const DONE_ICON = '<svg class="thread-rc-doneicon size-4" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="#00B398" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">' + '<path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/>' + '<polyline points="22 4 12 14.01 9 11.01"/></svg>';
    const COURSES = [{
      slug: "technician",
      steps: ["why-thread", "get-around-inbox", "day-one-setup", "daily-workflows", "ai-toolkit", "notifications-and-customers"]
    }, {
      slug: "dispatcher",
      steps: ["why-dispatch-in-thread", "read-the-board", "assign-and-schedule", "ai-for-dispatch"]
    }, {
      slug: "service-ops-manager",
      steps: ["set-up-the-desk", "sla-and-dispatch", "analytics-and-qa", "roll-out-and-adopt"]
    }, {
      slug: "csm-account-manager",
      steps: ["client-intelligence-and-health", "qbrs-and-reporting", "retention-and-expansion"]
    }, {
      slug: "security-compliance-owner",
      steps: ["security-work-in-thread", "data-and-compliance", "security-runbooks"]
    }, {
      slug: "sales-business-development",
      steps: ["the-ai-service-pitch", "quote-and-handoff"]
    }, {
      slug: "msp-owner-leadership",
      steps: ["the-rollout", "outcomes-and-analytics", "scale-ai-service"]
    }, {
      slug: "automation-engineer",
      steps: ["flows-and-intents", "thread-mcp-and-api", "build-with-super-magic"]
    }];
    const COURSE_SLUGS = new Set(COURSES.map(c => c.slug));
    const readLocal = () => {
      try {
        return JSON.parse(localStorage.getItem(KEY) || "[]");
      } catch (e) {
        return [];
      }
    };
    const isDone = (done, id) => done.includes(id);
    const decorate = () => {
      const done = readLocal();
      const scope = document.getElementById("sidebar-content") || document;
      const links = [...scope.querySelectorAll('a[href*="' + BASE + '"]')].filter(a => !a.closest("main"));
      links.forEach(a => {
        const m = (a.getAttribute("href") || "").match(/\/start-here\/roles\/([^/?#]+)\/([^/?#]+)/);
        if (!m) return;
        if (!COURSE_SLUGS.has(m[1])) return;
        const id = m[1] + "/" + m[2];
        const d = isDone(done, id);
        const has = a.querySelector(".thread-rc-check");
        if (d && !has) {
          const s = document.createElement("span");
          s.className = "thread-rc-check";
          s.textContent = "✓ ";
          s.style.color = TEAL;
          s.style.fontWeight = "700";
          a.insertBefore(s, a.firstChild);
        } else if (!d && has) {
          has.remove();
        }
      });
      COURSES.forEach(course => {
        const li = scope.querySelector('li[id="' + BASE + course.slug + '"]');
        if (!li) return;
        const row = li.querySelector(":scope > button") || li.querySelector(":scope > a") || li.firstElementChild;
        if (!row) return;
        const nameSpan = [...row.querySelectorAll("span")].find(s => s.textContent.trim() && !s.classList.contains("thread-rc-coursecheck"));
        if (!nameSpan) return;
        const allDone = course.steps.length > 0 && course.steps.every(s => isDone(done, course.slug + "/" + s));
        const has = nameSpan.querySelector(".thread-rc-coursecheck");
        if (allDone && !has) {
          const s = document.createElement("span");
          s.className = "thread-rc-coursecheck";
          s.setAttribute("aria-hidden", "true");
          s.style.display = "inline-flex";
          s.style.alignItems = "center";
          s.style.verticalAlign = "-0.2em";
          s.style.marginRight = "0.35em";
          s.innerHTML = DONE_ICON;
          nameSpan.insertBefore(s, nameSpan.firstChild);
        } else if (!allDone && has) {
          has.remove();
        }
      });
    };
    decorate();
    const iv = setInterval(decorate, 600);
    window.addEventListener("thread-onboarding-updated", decorate);
    window.addEventListener("storage", decorate);
    return () => {
      clearInterval(iv);
      window.removeEventListener("thread-onboarding-updated", decorate);
      window.removeEventListener("storage", decorate);
    };
  }, []);
  return null;
};

<ByRoleProgress />

You run security response and SOC work, own audit and compliance posture, and vet how every tool touching your desk handles data and permissions. Thread changes three things for you: security signals arrive already scored and routed, Super Magic does read-only investigation and confirm-before-act response from inside the ticket, and the data-handling story you have to defend to clients and auditors is written down and specific. This is your course — three lessons that cover the ticket flow, the data model, and the runbook bench, plus the skills and ritual built for your day.

## The course

Work these in order — each ends with a link to the next. The first two lessons are the operating model; the third is your day-to-day toolkit.

<Steps>
  <Step title="How security work flows through Thread">
    Sentiment and escalation on security threads, Super Magic lookups with confirm-before-act, and NinjaOne device actions from the ticket. [Read →](/start-here/roles/security-compliance-owner/security-work-in-thread)
  </Step>

  <Step title="How Thread handles your data">
    Encryption, Magic AI privacy, sub-processors, IP allowlisting, and the exact app permissions to hand an auditor. [Read →](/start-here/roles/security-compliance-owner/data-and-compliance)
  </Step>

  <Step title="Your security & compliance runbooks">
    The Skill Library security and audit bench — incident response, identity, alerts, and evidence collection. [Read →](/start-here/roles/security-compliance-owner/security-runbooks)
  </Step>
</Steps>

## Your starter kit

The [Skill Library](/skill-library/overview) has a full security and compliance bench. Start with these, then press **`⌘K`** and search ("phishing", "BEC", "ransomware", "audit", "SOC 2") for the rest.

<CardGroup cols={2}>
  <Card title="Phishing Triage" icon="fish" href="/skill-library/security/phishing-triage">
    Assess a reported email and contain it if it's malicious.
  </Card>

  <Card title="Account Takeover Runbook" icon="user-lock" href="/skill-library/security/account-takeover-runbook">
    The full response for a compromised account, step by step.
  </Card>

  <Card title="Ransomware Response" icon="skull-crossbones" href="/skill-library/security/ransomware-response">
    Contain, communicate, and coordinate recovery under pressure.
  </Card>

  <Card title="Identity & MFA Health Check" icon="fingerprint" href="/skill-library/security/identity-mfa-health-check">
    Find identity and MFA gaps before an attacker does.
  </Card>

  <Card title="Audit Prep Review" icon="clipboard-check" href="/skill-library/compliance-and-audit/audit-prep-review">
    Get ready for an audit or assessment without the scramble.
  </Card>

  <Card title="SOC 2 Evidence Collection" icon="folder-tree" href="/skill-library/compliance-and-audit/soc2-evidence-collection">
    Gather and organize the evidence a SOC 2 cycle demands.
  </Card>
</CardGroup>

## Your SOC ritual

<CardGroup cols={2}>
  <Card title="SOC shift handoff" icon="arrows-rotate" href="/skill-library/security/soc-shift-handoff">
    End every shift with a clean handoff — open incidents, what's watched, what's next.
  </Card>

  <Card title="Monthly security report" icon="file-shield" href="/skill-library/security/monthly-security-report">
    Turn a month of security work into client-ready proof.
  </Card>
</CardGroup>

Run the SOC shift handoff at the close of every shift so nothing in-flight gets dropped across the seam, and the monthly security report at month-end so the work you did is visible to the clients paying for it. Between those, [SOC shift handoff](/skill-library/security/soc-shift-handoff) plus a queue scan is your open-and-close.

## Pro tips & FAQ

<AccordionGroup>
  <Accordion title="Does Thread hold a SOC 2 or other certification I can cite?">
    The **SOC 2 Type II audit is in progress** and the report has not been issued yet — so don't tell a client Thread "is SOC 2 certified". A bridge letter is available under NDA through your Customer Success Manager. Full detail, and the links you can send a client, are on [Thread's SOC 2 and compliance status](/security-billing/soc-2-and-compliance-status); the [Trust Center](https://app.vanta.com/getthread.com/trust/lp3d2rffaud4mely4xay7b) carries the live status and is what you should link in a questionnaire. These docs also give you the technical detail auditors ask for: [data encryption](/security-billing/data-encryption), [Magic AI privacy & security](/security-billing/magic-ai-privacy-security), and the [sub-processor list](/security-billing/list-of-sub-processors). The compliance skills help you assemble *your own* evidence, not stand in for Thread's attestations.
  </Accordion>

  <Accordion title="Can Super Magic change something in my PSA without me knowing?">
    No. Super Magic reads freely, but every write action shows a **Confirm action** card first — the exact ticket, status, or note — and nothing runs until you click **Confirm**. Confirmed changes are recorded under the member's own name, not a service account. See the [Super Magic admin guide](/super-magic/super-magic-admin-guide-setup-access-safety).
  </Accordion>

  <Accordion title="Who can trigger write actions and device commands?">
    You control it. Write access is set to All members, Admins only, or a custom list, with a per-tool toggle on every action. NinjaOne device actions additionally run under each member's *own* NinjaOne permissions — a technician can never do more through Super Magic than they could do signed into NinjaOne directly. Details in the [Super Magic admin guide](/super-magic/super-magic-admin-guide-setup-access-safety).
  </Accordion>

  <Accordion title="My clients enforce IP allowlisting — what do I give their network team?">
    Thread's outgoing IPs (for PSA API calls) and the incoming domains Inbox and Messenger need are listed on [Thread IP addresses and domains to allowlist](/security-billing/what-if-my-organization-has-ip-restrictions). Hand that page to the network team verbatim.
  </Accordion>

  <Accordion title="What data does Magic AI actually send out?">
    A short, fixed list — contact name and type, the date, and the issue's summary, description, and transcript — to an isolated Azure OpenAI Service instance that doesn't store it or train on it. The exact fields are on [Magic AI privacy & security](/security-billing/magic-ai-privacy-security).
  </Accordion>
</AccordionGroup>


## Related topics

- [Abnormal Security](/skill-library/vendor-runbooks/abnormal-security.md)
- [Security Advisory Broadcast](/skill-library/communication/security-advisory-broadcast.md)
- [Security Incident Postmortem](/skill-library/security/security-incident-postmortem.md)