Trust CenterSecurity

Security Architecture

Harch Corp security is designed from the ground up — not bolted on. Every component, from physical data center perimeters to application code, is built with defense in depth and zero-trust principles.

Physical & Network Security

Our data centers are sovereign fortresses — physically secured, network-isolated, and continuously monitored. Every byte that enters or leaves is inspected.

Physical Security

Access Control

Multi-factor biometric authentication (fingerprint + iris + badge). Mantrap entry points with interlocking doors. Visitor escort required at all times.

Surveillance

24/7 CCTV with 90-day retention. AI-powered anomaly detection on all camera feeds. No blind spots in data halls.

Environmental

N+1 cooling redundancy. Fire suppression with VESDA early warning. Seismic-rated construction for all critical facilities.

Personnel

Background-checked security staff 24/7. Regular physical penetration testing. Strict tailgating prevention policies.

Network Security

DDoS Protection

Multi-layer DDoS mitigation with 10Tbps+ scrubbing capacity. Always-on protection with automatic traffic rerouting during volumetric attacks.

Micro-Segmentation

Zero-trust network architecture. Every workload isolated in its own security zone. East-west traffic encrypted and authenticated.

WAF & API Gateway

Next-gen WAF with ML-powered threat detection. API gateway with rate limiting, schema validation, and bot protection.

Submarine Cable Security

Dedicated fiber paths with tamper detection. Encrypted point-to-point links between Morocco and EU landing stations.

Secure by Default

Every line of code is reviewed, every dependency is scanned, every deployment is tested. Security is not a phase — it is a continuous practice embedded in our development lifecycle.

Code Review & SAST

Every merge request requires security review. Static analysis (SAST) scans for vulnerabilities, secrets, and misconfigurations before code reaches production. Zero-trust in the CI/CD pipeline.

Avg Review Time<4 hrs
SAST Coverage100%
False Positive Rate<3%

Penetration Testing

Annual third-party penetration testing by NCC Group, plus continuous automated DAST scanning. Bug bounty program supplements with real-world attack simulation by ethical hackers.

Annual Pentests4+
Critical Findings0 in 2025
Remediation SLA<72 hrs

Vulnerability Management

Continuous vulnerability scanning of all infrastructure and applications. Risk-based prioritization with automated patching for critical CVEs within 24 hours of disclosure.

Scan FrequencyContinuous
Critical Patch SLA<24 hrs
SBOM Coverage100%

Encryption Everywhere

Data is encrypted at every stage — at rest, in transit, and during processing. Customer-managed keys give you full control over your encryption boundaries.

Encryption at Rest

AlgorithmAES-256-GCM
Key ManagementHSM-backed KMS
Key RotationAutomatic, 90-day
Customer-Managed KeysSupported (CMK)
Volume EncryptionAll storage volumes
Backup EncryptionEncrypted at rest

Encryption in Transit

ProtocolTLS 1.3 (minimum)
Certificate AuthorityDigiCert / Internal CA
Certificate RotationAutomated, 90-day
Perfect Forward SecrecyEnabled
Internal Service MeshmTLS (Istio)
Submarine LinksMACsec + IPsec

Zero-Trust Identity

Never trust, always verify. Every access request is authenticated, authorized, and encrypted — regardless of origin. Identity is the new perimeter.

Multi-Factor Authentication

MFA enforced for all users — no exceptions. Support for TOTP, WebAuthn/FIDO2, hardware keys, and push notifications. Phishing-resistant authentication options available.

Role-Based Access Control

Fine-grained RBAC with least-privilege defaults. Custom roles for complex organizational structures. Just-in-time access provisioning with automatic expiration.

Privileged Access Management

All privileged sessions recorded and audited. Just-in-time elevation with approval workflows. Automated credential rotation for service accounts.

Conditional Access Policies

Context-aware access decisions based on device posture, location, risk score, and time of access. Automatic step-up authentication for high-risk operations.

Single Sign-On (SSO)

SAML 2.0 and OIDC integration with all major identity providers. SCIM-based user provisioning and deprovisioning. Session management across all Harch Corp services.

Audit & Compliance

Every authentication and authorization event logged immutably. Real-time alerting on suspicious access patterns. Quarterly access reviews with automated deprovisioning.

Security Bulletins

Transparent disclosure of security updates, patches, and vulnerability remediations. We publish every relevant security event — not just the ones that make us look good.

IDTitleSeverityDateStatus
HCSB-2025-008TLS Certificate Rotation — HarchOS Control PlaneLowDec 15, 2025Resolved
HCSB-2025-007Rate Limiting Update for API Gateway v2LowNov 28, 2025Resolved
HCSB-2025-006Kernel Patch — CVE-2025-3072 RemediationMediumOct 12, 2025Resolved
HCSB-2025-005Network Segmentation Enhancement — East/West TrafficLowSep 20, 2025Resolved
HCSB-2025-004Dependency Update — Log4j Variant RemediationHighAug 5, 2025Resolved

Rapid. Structured. Transparent.

Our incident response process is designed for speed and accountability. Every phase has defined SLAs, clear ownership, and mandatory documentation.

01

Detection

SLA: <15 min

Automated detection via SIEM, IDS/IPS, and anomaly detection. 24/7 SOC monitoring with real-time alerting.

SIEM correlation triggers
IDS/IPS alert validation
Threat intelligence matching
Anomaly detection scoring
02

Triage

SLA: <30 min

Security analyst validates the alert, assigns severity, and activates the appropriate incident response playbook.

Alert validation & classification
Severity assignment (P1-P4)
Playbook activation
War room provisioning
03

Containment

SLA: <1 hr

Immediate containment actions to prevent spread. Short-term and long-term containment strategies deployed in parallel.

Network isolation of affected systems
Credential rotation
Traffic filtering & blocking
Evidence preservation
04

Eradication

SLA: <4 hrs

Root cause identification and complete removal of threat actor presence. All compromised assets identified and remediated.

Root cause analysis
Malware removal & system hardening
Vulnerability patching
Threat actor eviction verification
05

Recovery

SLA: <8 hrs

Services restored with enhanced monitoring. Validation testing confirms threat elimination and service integrity.

Staged service restoration
Enhanced monitoring deployment
Integrity verification
Performance validation
06

Post-Incident

SLA: <5 days

Comprehensive post-incident review. Lessons learned documented and shared. Controls updated to prevent recurrence.

Post-mortem report
Control gap remediation
Playbook updates
Transparency report update

Security Questions?

Our security team is available for detailed architecture reviews, threat model discussions, and custom security assessments.