01
Hardware-Backed Keys
Bring your own KMS — AWS KMS, Azure Key Vault, or GCP Cloud KMS — and the root of trust stays in your account. Platform-managed custody uses a per-tenant software KMS.
Security & accessGENEDATA / 01
Protect the data.Preserve the trust.
Bring identity, access controls, encryption, and audit into one security model across your data workflows.
Shared context · Lineage · Governance
Connected
Your sources
Identity
Workload context
Security policies
Connected intelligenceAccess controls
Governance
Business impactAuditable operations
Shared contextLineageGovernance
02
Zero-Trust Network
Private-link ingress, mTLS everywhere, attribute-based authorization at every API. No VPN, no flat network, no implicit trust.
03
Tamper-Evident Audit
Every action signed and chained — auditors can mathematically verify the audit log has not been altered, even by platform admins.
Defence Layers
Five layers, and none of them assume the previous one held.
Zero trust means each layer re-verifies rather than inheriting a decision made upstream. A compromised network position does not yield identity, a valid identity does not yield authorisation, and no combination yields the ability to alter the audit record.
How It Works
Verify, authorise, encrypt, attest.
The sequence runs on every request, including internal service-to-service calls and AI inference.
Verify the channel
Private-link ingress with mutual TLS. There is no flat internal network where a foothold implies reachability.
Establish identity
Federated SSO issues short-lived, scoped credentials. Long-lived static keys are not part of the model.
Authorise the action
Attribute-based authorisation runs per request against the resource, the actor, and the context — not once at session start.
Attest the outcome
The action is signed and appended to a hash-chained log, so any later alteration is mathematically detectable.
Capabilities
Controls a CISO can evidence.
Each of these produces an artefact you can hand to an auditor or a customer's security review.
Customer-managed keys
Bring your own cloud KMS, or use platform-managed custody in a per-tenant software KMS, with revocation under your control.
Encryption everywhere
AES-256 at rest and TLS 1.3 in transit, including between internal services and to inference endpoints.
Hash-chained audit
Each entry signs its predecessor, so tampering is detectable even by an actor with administrative access.
Behavioural detection
Anomalous query volume, unusual export patterns, and off-hours access raise alerts against a learned baseline.
Just-in-time elevation
Privileged operations require approved, time-boxed elevation that expires without manual revocation.
Break-glass with witness
Emergency access is possible, always recorded, and always notifies a second party at the time it is used.
In Practice
Who this is for.
Security work is mostly answering other people's questions with evidence.
CISO / Security
Answer the security questionnaire from data
Respond to customer due-diligence and regulator questions by querying the platform's own control records rather than restating policy documents.
Assertions backed by queryable evidence.
Incident Response
Reconstruct exactly what was touched
During an investigation, replay every access by an identity across every layer, with the audit chain proving the record is intact.
Scoping based on record, not inference.
Platform / SRE
Operate without standing privilege
Day-to-day operations run without production data access; privileged actions require time-boxed elevation with a witness.
The blast radius of a compromised operator account shrinks.
What Changes
What changes when security is in the engine.
Perimeter security assumes the inside is safe. Everything here assumes it is not.
| Dimension | Before Genedata | With Genedata |
|---|---|---|
| Network model | VPN into a trusted internal network | Private link and mTLS, no implicit trust anywhere |
| Credentials | Long-lived keys distributed to services | Short-lived, scoped, federated credentials |
| Authorization | Checked at session start, then assumed | Evaluated per request against live context |
| Audit integrity | A log an administrator could edit | Hash-chained entries where tampering is detectable |
| Evidence | Policy documents and screenshots | A continuous, queryable control record |
AES-256 + TLS 1.3Encryption
Per-tenant KMSKey Management
Hash-chainedAudit Tamper-Proof
On-call + postmortemIncident Process
The next step
Security posture you can prove, not just claim.
Genedata Security gives your CISO continuous, queryable evidence — covering encryption, identity, network, and behavior. When auditors or customers ask 'how do you know?', the answer is a SQL query, not a slide deck.
FAQ
Security, answered.
The questions that appear in every enterprise security review.
Who holds the encryption keys?
You can. Bring your own KMS — AWS KMS, Azure Key Vault, or GCP Cloud KMS — or use platform-managed custody in a per-tenant software KMS. Either way revocation is under your control, and revoking a key is an effective kill switch on the data it protects.
What does zero trust mean concretely here?
Each layer re-verifies rather than inheriting an upstream decision. A network position does not yield identity, a valid identity does not yield authorisation, and no combination yields the ability to alter the audit record.
Can a platform administrator tamper with the audit log?
No, and that is checkable rather than promised. Each entry signs its predecessor, so any alteration breaks the chain and is mathematically detectable — including by an actor with administrative access.
How are credentials handled?
Federated SSO issues short-lived, scoped credentials. Long-lived static keys distributed to services are not part of the model, which removes the most commonly exploited credential class.
What about emergency access?
Break-glass access exists, is always recorded, and always notifies a second party at the time it is used. Privileged operations otherwise require approved, time-boxed elevation that expires without manual revocation.
Related content
Whitepaper
Security Whitepaper
Threat model, control catalog, and key management architecture.
RunbookIncident Response
Playbooks for containment, scoping, and evidence preservation.
ComplianceControl Mapping Pack
Controls mapped to SOC 2, ISO 27001, HIPAA, and GDPR.
StatusPlatform Status
Live health and incident history across every region.
Take the next step
Bring us your security review.
Work through your questionnaire with our security team, or start with the whitepaper and control catalog.