Security Protocol

1. Layered Ingress Architecture

Our security model follows a multi-stage verification pipeline to ensure that only authorized telemetry signals reach our internal buffers. This process is clinical, automated, and mathematically enforced.

1.1 Handshake Protocol

Institutional access is governed by signed JWT-based handshakes. Every SDK pulse requires a valid cryptographic signature derived from your private intervention secret. We utilize 15-minute rotation cycles for session markers to mitigate replay risks.

1.2 Metadata Isolation (Firewall)

The Metadata Firewall is a logical barrier implemented at the SDK level. It ensures that weight tensors, raw datasets, and proprietary model architectures never traverse the network boundary. Only the clinical scalars required for failure detection (e.g., loss, gradient norms) are packaged for transmission.

1.3 Sanitization Gate

Incoming pulses are processed by our Python-based Data Acceptor. This gateway validates the schema of every signal, stripping unapproved metadata keys or potential PII before the data is committed to the institutional Metadata Vault.

1.4 Transit Security

We enforce TLS 1.3 encryption with certificate pinning for all SDK iterations. The Argus Control Plane refuses handshakes from any client utilizing legacy protocols (TLS 1.2 or below).

2. Physical Infrastructure Hardening

Datawiser LLC utilizes AWS production environments specifically hardened for high-stakes AI compute. Our infrastructure is deployed in isolated Virtual Private Clouds (VPCs) with zero direct public ingress.

• Ingress Filtering: We use AWS Shield Advanced and AWS WAF for application-layer protection and DDoS mitigation.
• Encryption at Rest: All stored telemetry is encrypted using AES-256 with key management and rotation handled by AWS KMS.
• Regional Sovereignty: Unless otherwise specified in a custom DPA, all metadata is stored and processed exclusively in US-EAST-1 (N. Virginia).

3. Business Continuity and Disaster Recovery

We maintain strictly defined recovery objectives for the Metadata Vault, ensuring the integrity of your forensic records even during catastrophic infrastructure failures.

Our Recovery Point Objective (RPO) is strictly documented at < 15 minutes, and our Recovery Time Objective (RTO) is targeted at < 4 hours. Automated cross-availability-zone (Cross-AZ) failovers are enabled for all primary ingestion caches.

4. Internal Audit

We perform monthly internal security audits of the Argus core logic. This includes signal injection testing, IAM permission reviews, and forensic log reconciliation to ensure the absolute integrity of our non-custodial monitoring pipeline.