KNOWLEDGE-BASE
Notes techniques & réponses d'architecture.
INFRASTRUCTURE & CYBER-RESILIENCE
CISO Track — Cryptography, Isolation & Active Monitoring.
PHYSICAL & LOGICAL ISOLATION. Unlike shared SaaS architectures (Multi-Tenant), CEREBRO deploys dedicated infrastructure for each institutional client.
Infrastructure: 1 dedicated VPS + 1 dedicated PostgreSQL instance + 1 dedicated Vault namespace.
Network: Isolation via private VLAN.
Guarantee: Structural elimination of side-channel leakage vectors and cross-instance corruption.
SECRETS MANAGEMENT & EPHEMERAL CRYPTOGRAPHY. We apply the AES-256-GCM standard for all data at rest.
Management: Keys are never stored on disk. They reside only in volatile memory, dynamically injected by HashiCorp Vault.
Rotation: Dynamic rotation of application secrets (TTL < 15 min).
Break-Glass: Our engineers have no 'default' access. Any intervention requires tracked and audited privilege escalation.
OPERATIONAL RESILIENCE (DORA FRAMEWORK). Our backup strategy follows the 3-2-1 rule with specific anti-ransomware protection.
RPO < 5 min: Continuous archiving (WAL) and Point-in-Time Recovery (PITR).
RTO < 30 min: Orchestration via Infrastructure as Code (IaC).
Backups are stored on immutable object storage (WORM) and encrypted with a key separate from production.
ZERO-TRUST GOVERNANCE & mTLS. CEREBRO trusts no user or network, even internal ones.
Identity: Cockpit access requires strong MFA authentication.
Network: All communications between microservices (e.g., API to AI) are mutually authenticated (mTLS).
Segmentation: A compromise on one module (e.g., Email Gateway) cannot enable lateral movement to core systems (e.g., Database), thanks to strict privilege segregation.
NO. EUROPEAN SOVEREIGNTY GUARANTEED. Isolated private instances (Azure France Central): Complete separation from public models.
Jurisdiction: Your data never passes through OpenAI's public US servers. It remains under European jurisdiction (GDPR / Schrems II).
Confidentiality: Microsoft contractually commits that your data is never used to train foundation models (No Training Policy).
MONITORING & THREAT HUNTING (SOC-READY). Infrastructure is monitored in real-time by an offensive security stack.
Behavioral Analysis: Wazuh agents scan system logs to detect anomalies.
Automated Response: Fail2ban immediately bans any IP attempting suspicious actions (Bruteforce, Port Scan).
Integrity: A File Integrity Monitor (FIM) alerts instantly if a critical system file is modified.
EVIDENCE LAYER: TRACE INTEGRITY (WORM). All critical actions (CCO Validation, Analyst Rejection, Login) are logged in an immutable registry.
Technology: Write Once, Read Many. Once written, a log cannot be modified or deleted.
Compliance: This architecture ensures evidentiary value of traces for regulatory audits or post-incident investigations.
ENGINEERING & SMTP INTERCEPTION
DevOps Track — Real-Time Performance & Native Resilience.
DEEP-LINK INTERCEPTION (IN-LINE). CEREBRO doesn't use API 'Polling' (too slow). We act as a transparent SMTP node inserted into the outbound flow via Exchange/Workspace Connectors.
Latency: P95 Latency < 200ms. The Triple-Engine AI analysis is optimized for near-instant execution with zero business friction.
Deliverability: Zero impact on your IP reputation. CEREBRO relays approved emails to your origin server (M365/Google) for final delivery. Your DKIM, SPF, and DMARC signatures remain intact.
CRITICAL RESILIENCE: NATIVE FAIL-OPEN. Your business must never stop. We leverage native resilience mechanisms of Transport Rules (Exchange/Google).
Mechanism: Fail-Safe Architecture: If latency > 3s is detected, the flow is released instantly to ensure business continuity.
Result: Email flow 'bypasses' CEREBRO and exits directly. No email is ever lost or blocked by our infrastructure failure (DORA Compliance).
ZERO-INTRUSION DEPLOYMENT (SERVER-TO-SERVER). Integration is completely transparent to end users.
Zero Plugin: No Outlook Add-in or Chrome extension to deploy and maintain.
Compatibility: Works natively on Mobile, Web, and Desktop.
Method: Centralized configuration via 'Outbound Connectors' and 'Transport Rules' of your Microsoft 365 or Google Workspace tenant. Detailed technical documentation is provided to your IT team (Est. IT effort: 5 days), plus expert guidance throughout integration.
ZERO API QUOTA DEPLETION. This is a key distinction of our architecture.
CRM: Streaming Consumption: JWT Bearer authentication via gRPC Pub/Sub (Salesforce Event Relay).
Email: SMTP routing consumes no Graph API call quota.
Benefit: You can deploy CEREBRO at scale without risking 'bricking' your other critical integrations.
SOC-READY OBSERVABILITY. Yes. CEREBRO is designed to integrate with your SOC (Security Operations Center).
Logs: All security events (blocks, fraud attempts, access) are exportable via API or secured Webhooks.
Format: Standardized structured JSON, ready for ingestion by your existing monitoring tools.
GOVERNANCE & REGULATORY COMPLIANCE
DPO/CCO Track — Sovereignty, DORA Resilience & Evidence Integrity.
LEGAL IMMUNITY & DATA RESIDENCY. All data (Databases, Logs, Backups) is hosted in France (Gravelines/Roubaix region) on OVHcloud infrastructure certified ISO 27001 and HDS.
Legal Immunity: As a French company hosted in France, your data is not subject to US extraterritorial laws (Cloud Act).
Isolation: Strict Single-Tenant architecture (1 dedicated VPS per client). No storage sharing with other entities.
DORA FRAMEWORK: OPERATIONAL RESILIENCE. CEREBRO is natively designed to meet DORA regulation pillars:
Continuity (Fail-Open): Our SMTP architecture ensures that in case of critical failure, email flow is never blocked (Automatic Bypass).
Resilience Tests: RTO < 30 min / RPO < 5 min: Active resilience tested monthly.
Third-Party Management: We provide full transparency on our subcontracting chain (Software Supply Chain).
EVIDENCE LAYER: EVIDENTIARY INTEGRITY (WORM). To meet AML-CFT requirements, we ensure absolute trace integrity.
Technology: WORM Storage (Write Once, Read Many). An audit trace (e.g., suspicious email validation) is cryptographically sealed and becomes immutable.
Retention: Configurable per your internal policy (Standard: 2 years minimum, extendable to 5 or 10 years for legal archiving).
REVERSIBILITY & CRYPTO-SHREDDING PROTOCOL. We guarantee you'll never be locked in (Vendor Lock-in).
Export: On request, complete extraction of your data (Logs, Decisions, Metadata) in standard open formats (JSON, CSV, SQL).
Destruction: At contract end, we perform Crypto-Shredding: destroying your dedicated Vault encryption keys instantly makes all your data mathematically unrecoverable, followed by secure disk erasure (shred).
SECRETS GOVERNANCE (VAULT-AS-A-SERVICE). No secret is hardcoded in source or environment variables. We use HashiCorp Vault with strict AppRole authentication.
Rotation: Dynamic rotation (TTL < 15 min): Ephemeral secret injection.
Isolation: If a service is compromised, blast radius is zero since secrets are only valid for a specific context.
MULTI-LAYER ACTIVE DEFENSE. Infrastructure is protected by a real-time offensive security stack.
Network Level: Strict UFW filtering (Deny All by default) and Cloudflare protection.
Application Level: Advanced Rate Limiting middleware (Sliding Window) with SHA-256 fingerprinting to block API abuse.
Automated Response: Fail2ban immediately bans any IP attempting suspicious actions (6 active jails).
3-2-1 RULE & ASYMMETRIC ENCRYPTION. We apply the golden rule of backup to ensure data resilience.
3 Copies: Production + Local Backup + Off-site Backup.
2 Media Types: NVMe Disks (Performance) + Sovereign Object Storage (Archiving).
1 Remote Site: Secured asynchronous replication to a geographically separate datacenter (OVH Roubaix/Gravelines).
Security: All backups are encrypted in AES-256-GCM before leaving the server.
EX-ANTE GOVERNANCE & CONSENSUS ENGINE. False positive rate is maintained under 2% thanks to our Multi-Agent architecture.
Consensus: An email is only blocked if the weighted consensus of 6 agents exceeds a critical threshold (Score > 70).
Release: In case of doubt, email is quarantined and a 'Review' notification is sent to the CCO. Release is instant (One-Click) from the secured cockpit.
SEMANTIC ADHERENCE CONTROL (SAC). We don't trust—we verify. The system analyzes responses drafted by your sales reps before sending.
Control: The engine semantically compares the sales rep's response with the AI's compliance recommendation (Adherence Score).
Enforcement: Ex-Ante Enforcement: Immediate SMTP flow block (Kill Switch) before network exit.