Salt Security is an API security platform. It discovers an organisation's APIs, maps their traffic and detects attacks and abuse, such as anomalous behaviour by users or bots. The vendor works agentlessly and connects to the gateways, WAFs and SOC tooling an organisation already runs, with dozens of integrations. It is delivered as a cloud service; in hybrid set-ups, sensitive data is masked and hashed in the customer's own environment before it reaches Salt's cloud, according to the vendor.
The vendor, Salt Security, Inc., is based in Palo Alto in the United States. The service runs on AWS and, according to the data processing addendum, is deployed across three availability zones, with a backup region in the same geography, for example the US or the EU. The privacy policy mentions processing in the United States, Israel and the EU. Salt publishes a data processing addendum with standard contractual clauses for transfers from the EEA. A European organisation should confirm the region per deployment and review the sub-processor list itself.