Services · Architecture alignée sur les exigences ANSSI, NIS2 et RGPD

CSH Services — AI security review

Audits cadrés, revues de sécurité IA et surveillance gérée réalisés par nos ingénieurs sécurité. (Architecture review of LLM applications, agents and MCP integrations.)

Open in Live Console (ws-aiguard) Réserver une démo

Architecture & Capabilities

Pour les équipes qui exigent des preuves

Agent & MCP registry

Inventory every agent, model, owner and MCP server in one place.

Tool allowlists

Define exactly which tools each agent may call, per environment.

Prompt-injection defence

Detect indirect injection in user input and retrieved content.

Secret & PII redaction

API keys, tokens and personal data are removed before inference.

Human approval

Writes, payments and shell commands are routed for step-up approval.

Decision log

Every allow, block and approval is recorded with its rationale.

Visual Architecture

Pre-Inference MCP & Agent Firewall

Inspects every Model Context Protocol (MCP) tool invocation, enforcing per-environment allowlists and blocking indirect prompt-injection payloads before execution.

Visual Architecture

DLP Secret Scrubbing & Audit Ledger

Automatically redacts bearer tokens, API keys and personal data before model inference and writes every allow/block decision to an append-only ledger.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with ANSSI Guides d'hygiène informatique, Directive NIS2 France, RGPD / CNIL.
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Questions fréquentes

L'IA prend-elle des mesures de confinement seule ?

Non. La détection repose sur des règles déterministes. ARYA SAI produit uniquement des synthèses consultatives à partir de preuves expurgées ; chaque action exige une validation humaine.

Où nos données sont-elles hébergées ?

Vous choisissez l'UE (Francfort) ou le Royaume-Uni (Londres) lors de l'intégration.

Accompagnez-vous la conformité NIS2, RGPD et ISO 27001 ?

Oui, CSH Compliance relie automatiquement les preuves techniques aux contrôles ISO/IEC 27001:2022, NIS2 et RGPD.

Pouvons-nous scanner n'importe quel domaine ?

Uniquement les actifs dont vous avez prouvé la propriété par jeton DNS TXT ou HTTP.

Travaillez-vous avec les fournisseurs de services gérés (MSP) ?

Oui, avec gestion déléguée des locataires et licences mutualisées.

Voyez-la tourner sur votre environnement

30 minutes avec un ingénieur sécurité. Sans slides.

Enregistrée au Royaume-Uni (N° 17372232)
Hébergement des données UK & UE
Disponible en 15 langues