Ordellum AnalyticsLaunching
Security and privacy
Six layers of defence protect sensitive compliance and identity data, from the network edge to round-the-clock monitoring.
1 Perimeter
2 Network
3 Identity
4 Application
5 Data
6 Monitoring
Customer data
Concentric diagram with six layers around a data core: perimeter, network, identity, application, data and monitoring.
- Perimeter
- Web application firewall, DDoS protection, bot management and rate limits.
- Network
- Isolated private networks with micro-segmentation; data stores are never exposed.
- Identity
- Single sign-on, short-lived tokens, API keys and multi-factor authentication.
- Application
- Input validation, output encoding, CSRF protection and secure headers.
- Data
- Encryption at rest and in transit, field-level encryption, key rotation and tokenisation.
- Monitoring
- Security event monitoring, anomaly detection and a round-the-clock response process.
How data is protected
- Data in transit
- Protection: TLS 1.3
- Data at rest and personal fields
- Protection: AES-256-GCM
- Keys
- Protection: Hardware security modules with envelope encryption and scheduled rotation
- Passwords
- Protection: Argon2id
- API requests and webhooks
- Protection: HMAC-SHA-256 signatures
- Tokens and credentials
- Protection: EdDSA (Ed25519) signatures
Access combines role-based and attribute-based control. Roles — platform administrator, compliance manager, compliance analyst, dApp client and read-only auditor — are combined with context such as time, location, data classification and tenant isolation in every decision.
Administrators and compliance users sign in with single sign-on and multi-factor authentication. Data is classified as confidential, restricted, internal or public, and identity documents and suspicious-activity reports receive the strongest protection.
- Masked before the model
- Wallet addresses and personal data are tokenised before any context reaches a model.
- Injection protection
- Instructions and data are kept apart, tools are allow-listed and outputs follow a strict schema.
- No excessive authority
- A policy engine and human approval sit between any model output and a consequential action.
- Model isolation
- Customer data is never used to train models, and model artefacts are signed and inventoried.
Security testing cadence
- Application penetration test
- Frequency: Quarterly
- Infrastructure penetration test
- Frequency: Every six months
- Red-team exercise
- Frequency: Annually
- Automated scanning
- Frequency: Continuous, on every build
Incident response targets
Severity: SEV-1
- Example
- Active breach or data leak
- Response
- Under 15 minutes
Severity: SEV-2
- Example
- Attack attempt or critical vulnerability
- Response
- Under 1 hour
Severity: SEV-3
- Example
- Suspicious activity
- Response
- Under 4 hours
Severity: SEV-4
- Example
- Informational
- Response
- Business hours