API SECURITY / MISSION CONTROL
Clear answers.
Defined responsibilities.
Know the boundaries before enabling a control.
CONTEXT → DECISION → EVIDENCE
Current service health
Loading the latest read-only checks…
Waiting for a timestamped observation10 answers
Can I use VI1 Call, VI1 Chat and VoxVain from this dashboard?
Prepared read-only connectors can bring call activity and voice-usage summaries into your organization workspace after validated activation. All three are currently off. They do not place calls, send messages or generate speech. See the integrations pages for exact data and limits.
What can the private dashboards do?
The owner and customer portals default to a Grafana view of recorded API outcomes. Customers also have scoped API access, evidence, reports, team and connection settings. Features that need a source or action connector stay unavailable until configured and verified. Billing is test mode only.
Is this an API security company?
Yes. Tucana Shield focuses its customer offering on API visibility, identity-aware authorization, request protection, evidence and controlled response. Host and network investigation remain an internal protection baseline.
Does the public lab use my API?
No. It evaluates fixed fictional examples in your browser. No customer connection, scan, credential or production action is involved.
Can a WAF stop cross-customer data access?
A WAF can inspect malicious request patterns, but the application must enforce which tenant owns an object and which operations a caller may perform. Both layers need testing.
Is the entire target stack live?
The architecture pages describe roles and prerequisites. Connection and acceptance status are environment-specific. A component is not represented as live merely because it appears in the stack.
Can AI agents respond automatically?
No autonomous assistant or remediation engine is currently provided. Owner AI settings perform synthetic connection checks; response approvals record decisions only. Future actions need a separately implemented, validated connector and explicit authority. See the portal feature guide for current scope.
Does formal verification prove the whole platform is secure?
No. Formal proofs cover named model properties under explicit assumptions. Linking those proofs to implementation and deployed dependencies requires additional evidence.
Is 24/7 human response included?
Human review hours are agreed in the written pilot scope. A staffed 24/7 SOC and a guaranteed response time are not offered. Automation coverage depends on the connected and validated deployment.
What happens after I request a pilot?
The assessment request is saved for review. It is not a contract, subscription or activation. No confirmation email is sent, and no reply time is promised.
START WITH ONE API
Make the boundary visible.
Then prove the control works.
Bring your gateway, an API contract and a test environment. Define the evidence, owners and response limits for a scoped pilot.