Buyer-level view for CISOs and security architects evaluating Cyfriq. Six logical layers, one policy engine, zero cross-tenant exposure. A detailed deployment view (AWS components, VPC topology, KMS hierarchy) is available under NDA — request via security@cyfriq.com.
TLS 1.3 termination at the global Anycast edge. Geo / IP allowlist. DDoS protection. Customer-traffic mTLS for agent calls.
SAML 2.0 + OIDC identity provider. Every auth request is gated by MFA (FIDO2 / TOTP / push), live device trust, and configurable geo-policy.
One engine evaluates every action — login, email, web upload, file copy, USB write, paste. ML content classification + regex + fingerprinting.
Each tenant has its own root key in AWS KMS. All customer data is encrypted at rest with AES-256 using a per-record data key derived from the tenant's root key.
Every control-plane action is sealed to a tamper-proof log. Retained 5 years. Streamed to customer SIEM in real time. Regulator-replayable.
AWS ap-south-1 (Mumbai) by default. US-East and EU-West on request. Multi-AZ active-active. Data never crosses region without explicit customer action.
The per-tenant encrypted store and WORM audit log are built on ShaktiDB — India's indigenous, open-source, PostgreSQL-forked database, incubated at and backed by IIT Madras Pravartak. ACID-compliant, distributed with built-in replication and high availability, engineered for sovereignty and designed to align with RBI and CERT-In's SBOM directive.
The NDA-gated version includes AWS service breakdown (KMS, RDS, S3, Lambda, ECS, VPC layout, peering), failover topology, BCP/DR runbooks, and key-rotation procedure.
Request under NDA →