R&D Engines · Arquitetura alinhada com CNCS, NIS2, RGPD e ISO 27001

ARYA AIE TRUST — Guardian Core Agentic Firewall

Autonomous AI agent security policy gate, tool allowlisting, pre-inference DLP and mandatory human authorization (Frontier AI: SME Champions).

Open in Live Console (ws-aiguard) Agendar demo

ARYA AIE TRUST — Guardian Core Agentic Firewall

Architecture & Capabilities

Para equipas que precisam de provas, não de promessas

Agentic Firewall & Policy Gate

Inline interception of autonomous AI agent tool calls with pre-execution validation.

Strict Tool Allowlists

Granular per-agent, per-environment capabilities preventing unauthorized file, shell, or network access.

Indirect Prompt Injection Defense

Deep analysis of untrusted context documents and RAG retrievals preventing prompt override.

Dual-Control Human Sign-Off

Sensitive actions (financial transactions, data deletion, shell access) enforce mandatory human approval.

Visual Architecture

Pre-Execution Tool Authorization Gate

Intercepts Model Context Protocol (MCP) function calls to prevent data exfiltration and unauthorised shell execution.

Visual Architecture

Dual-Signoff Human Oversight Workflow

High-impact autonomous AI decisions pause in a tamper-evident queue awaiting designated operator approval.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with CNCS Quadro Nacional de Referência para a Cibersegurança, Diretiva NIS2, RGPD / LGPD.
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Perguntas frequentes

A IA executa ações sozinha?

Não. A deteção baseia-se em regras determinísticas e cada ação de contenção exige aprovação humana.

Onde ficam guardados os dados?

Escolhe entre UE (Frankfurt) ou Reino Unido (Londres) na ativação.

Apoiam a conformidade NIS2, CNCS e ISO 27001?

Sim, o CSH Compliance recolhe evidências técnicas contínuas para ISO/IEC 27001, NIS2 e RGPD.

Podemos analisar qualquer domínio?

Apenas ativos cuja propriedade tenha sido validada por DNS TXT ou token HTTP.

Trabalham com MSPs?

Sim, com gestão delegada de clientes e licenciamento partilhado.

Veja-a a funcionar no seu ambiente

30 minutos com um engenheiro de segurança. Sem diapositivos.

Registada no Reino Unido (N.º 17372232)
Residência de dados no UK e UE
Disponível em 15 idiomas