Security Architecture

1. Security philosophy

AlimNet operates a zero-trust, hardware-isolated model. We assume no implicit trust between tenants, networks, or workloads, and enforce segmentation at the kernel, switch, and physical layers.

2. Digital controls

• eBPF zero-trust microsegmentation: Cilium-based L3/L4/L7 policy enforcement with host-level isolation.
• FIPS 140-3 Level 3 HSM: hardware-backed key custody with AES-256-GCM and TLS 1.3, automated rotation, and quorum recovery.
• Encrypted access: WireGuard/IPsec tunnels peer tenant VPCs directly into Sylhet nodes; traffic never traverses the public internet.
• 24/7 SIEM/XDR SOC: autonomous threat hunting, DDoS mitigation, and air-gapped WORM snapshots.
• Bare-metal isolation: dedicated nodes with full root OS control and no cross-tenant hypervisor exposure.

3. Physical controls

• Zone 1 — Perimeter: anti-ram barriers, IR surveillance, 24/7 armed SEZ guards.
• Zone 2 — Facility: biometric iris + weight-scale mantraps, anti-tailgating, Novec 1230 clean-agent suppression.
• Zone 3 — Zero-trust cleanroom: eBPF inspection, FIPS 140-3 HSM, CCTV WORM audit logs.
• Zone 4 — Sovereign vault: isolated bare-metal pods, dual-custody access, air-gapped WORM RaaS.

4. Infrastructure resilience

• Dual 33 kV substation feeds with ATS and 30 kVA LiFePO4 UPS (0 ms bridge).
• N+2 diesel generators and dual 100 Gbps fiber routes.
• Direct-to-chip liquid cooling with 20°C ±2 intake and PUE 1.18.
• Redundant ToR switching, 200 Gbps NDR InfiniBand fabric, and 100 Gbps LR4 uplinks.

5. Compliance posture

• ISO/IEC 27001:2022 — Information Security Management System.
• SOC 2 Type II — annual Big-4 audit for security, availability, and confidentiality.
• PCI-DSS v4.0 Level 1 — financial tokenization workloads.
• Bangladesh Bank Cyber Security Guidelines and BTRC data-sovereignty alignment.

6. Incident response

We maintain documented SOPs for fluid-leak isolation, grid failure/ATS switchover, and air-gapped WORM restoration. Security incidents are triaged by the SOC, escalated to tenant contacts, and reviewed post-incident.

7. Responsible disclosure

If you believe you have found a vulnerability, please report it to security@alimnetnexus.com. Do not attempt to access tenant data or disrupt services. We will acknowledge valid reports and coordinate disclosure.

8. Shared responsibility

AlimNet secures the physical facility, hardware, power, cooling, and network fabric. Tenants are responsible for operating-system hardening, application code, container images, dataset encryption, and model execution. See the Terms of Service for the full boundary.