Visual Architecture
Three-Tier Defense-in-Depth Architecture
Combines PostgreSQL 16 FORCE ROW LEVEL SECURITY, deterministic Sigma detection and human-governed containment in one auditable control plane.
Resources · KISA ISMS-P, 개인정보보호법(PIPA) 및 글로벌 감사 기준 정밀 준수
Primary Research Bibliography & Standards Verification
Peer-reviewed literature and primary regulatory baselines across NISTIR 8259, UK PSTI, ETSI EN 303 645, ISO/SAE 21434, UNECE R155/R156, OCPP 2.0.1 and IEC 62443.
Architecture & Capabilities
약속이 아닌 증거가 필요한 팀을 위해
PostgreSQL 16 FORCE RLS
Every tenant table enforces database-level Row-Level Security bound to transaction-local current_tenant_id().
PII & secret redaction
Bearer tokens, API keys and personal data are scrubbed before any advisory call reaches ARYA SAI.
Human approval gate
No autonomous host isolation or credential revocation; every response action requires a named approver.
UK NCSC PQC roadmap
Cryptographic inventory tracking the 2028 discovery, 2031 priority and 2035 full Post-Quantum milestones.
Immutable audit trail
Append-only SHA-256 checksummed audit logs record every allowed and denied operation.
Regional data residency
Customer telemetry stays within the selected UK-LON, EU-FRA, MENA-RUH or APAC-TYO boundary.
Visual Architecture
Post-Quantum Cryptographic Lattice Vault
Tracks cryptographic assets and key rotation schedules against the UK NCSC 2028 discovery, 2031 priority and 2035 full migration milestones.
Verified Architecture Specifications · E-E-A-T Grounding Reference
Deterministic Technical Controls & Machine-Verifiable Evidence
- 1. Detection Engine (CSH Sentinel)
- Git-versioned Sigma rules (
CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001,T1098.003,T1048,T1190) with idempotentdedupe_keyingestion andSHA-256immutable event hashes. - 2. AI & MCP Firewall (CSH AI Guard)
- Pre-inference DLP scrubbing (
[REDACTED_SECRET],[REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking. - 3. Database Isolation (PostgreSQL 16)
- Enforces
ENABLE / FORCE ROW LEVEL SECURITYacross all 20 tenant tables bound to transaction-localcurrent_tenant_id(); cross-tenant queries fail closed withHTTP 403. - 4. Human-Gated Containment
- Zero autonomous destructive actions. Host isolation (
isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail. - 5. Verified Exposure & GRC (CSH Scan)
- Cryptographic
DNS TXTorHTTPownership token required before scanning. Continuous evidence aligned with KISA 정보보호 및 개인정보보호 관리체계 (ISMS-P), 개인정보보호법 (PIPA), 국가정보원 양자내성암호 (KpqC). - 6. Post-Quantum Roadmap (CSH Quantum)
- Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (
ML-KEM/ML-DSA), and 2035 full PQC completion.
Defense-in-Depth Isolation
Database-enforced tenant boundaries & UK NCSC PQC alignment.
- PostgreSQL 16
FORCE ROW LEVEL SECURITYon all 20 tenant tables. - Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
- Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.
db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16
ALTER TABLE security_events ENABLE ROW LEVEL SECURITY; ALTER TABLE security_events FORCE ROW LEVEL SECURITY; CREATE POLICY tenant_isolation_policy ON security_events FOR ALL TO csh_app_role USING (organization_id = current_tenant_id()) WITH CHECK (organization_id = current_tenant_id());
Isolation: Enforced · Cross-tenant queries return HTTP 403
자주 묻는 질문
AI가 사람 승인 없이 스스로 서버를 격리하나요?
아니요. 탐지는 결정론적 규칙으로 수행되며 모든 격리 조치는 지정된 관리자의 승인이 필수입니다.
데이터는 어디에 저장되나요?
온보딩 시 영국(런던), 유럽(프랑크푸르트) 또는 엔터프라이즈 APAC 리전을 선택할 수 있습니다.
ISMS-P 및 ISO 27001 인증 준비를 지원하나요?
네, CSH Compliance가 기술적 증적을 ISMS-P, PIPA 및 ISO/IEC 27001 통제 항목에 지속 연결합니다.
아무 도메인이나 스캔할 수 있나요?
DNS TXT 또는 HTTP 토큰으로 소유권을 증명한 자산만 스캔할 수 있습니다.
보안 관제 서비스 제공업체(MSP)와 협력하나요?
네, 위임 테넌트 관리와 라이선스 풀링을 지원합니다.
귀사 환경에서 직접 확인하세요
보안 엔지니어와 30분. 슬라이드 없이.
- 영국 등록 법인 (회사 번호: 17372232)
- 영국 및 EU 데이터 보관
- 15개 언어 지원