Customer 360 & Real-Time Risk Intelligence Platform · View 13 of 20

Security Architecture and Trust Zones

Trust boundaries from the internet through to the data plane, what crosses each one, and where an attacker is stopped.

Editable source SVG draw.io All views

Zone rule

No workload crosses a zone without an authenticated, logged and policy-checked hop
Processing clusters have no inbound internet route and no public endpoints
All service-to-service traffic inside the platform uses mutual TLS

PII protection

Card numbers and national identifiers are tokenised before they reach storage
Detokenisation is a policy-gated call, logged per invocation with purpose
Column masks and row filters are enforced in the catalog, not in each query tool

Key and access management

Customer-managed keys in an HSM-backed service, rotated on a fixed schedule
Privileged access is just-in-time, time-boxed and recorded
Access events stream to SIEM with 7-year immutable retention