Documentation contents
AarSOC · Your data
Sovereignty and confidentiality
Where your AarSOC data is hosted, who can access it, how it is isolated from other clients, how the AI handles it, and deploying on your side.
On this page
Hosting
In the offer operated by CyberAar, your data is on our servers in Europe (Helsinki, Finland), with a European infrastructure provider. Hosting in West Africa is being considered.
One exception: Citadelle’s AI assistant sends pseudonymised extracts to an external model (Claude, by Anthropic). Souveraine and the pilot have no AI: your data then never leaves our infrastructure.
AI on your data
- Only with Citadelle: alert triage, summaries and report drafts (beta).
- Before anything is sent to the model, our servers replace machine names, addresses, accounts, e-mails and client names with tokens, and mask secrets. Sending is refused if any original value survives.
- The AI suggests, an analyst decides: it closes, assigns and escalates nothing. Every AI intervention is logged.
Who can access your logs
The analysts assigned to your organisation, the SOC administrators and the engineers who run the platform. An analyst who is not assigned to you does not see your data. Opening an incident and its evidence is logged, as is API access to your archive. No access is given to sales staff or third parties.
Isolation between clients
Several levels:
- each client has its own tunnel and subnet;
- a machine is attached to a client only after SOC approval;
- your alerts are stored in your own indices;
- the portal database separates data per client on every row;
- every portal query is filtered to your organisation by the server.
There is no separate encryption key per client.
Protected reports
Exported PDFs are encrypted with AES-256 using a random password unique to each export, of which we keep only a hash. They travel over TLS, are accessible only to the authorised accounts of your organisation, and are never shared between clients.
Platform security
- TLS 1.2 or later on internal and external channels.
- Multi-factor authentication for operator access.
- Role-based access control, per organisation.
- Full audit trail, aligned with ISO/IEC 27001:2022.
- Network isolation: SOC and monitoring traffic on separate segments.
Our ISMS is aligned with ISO/IEC 27001:2022 and the certification process is under way. We do not claim certification until it is obtained.
Deploying on your side
It is possible: the platform is built on open-source components and the AarView software is available under licence. Such a deployment is prepared case by case with your teams (installation, configuration, skills transfer). The software is described in the AarView documentation.
Confidentiality
A non-disclosure agreement is signed before any exchange of sensitive information and before any access to your data. The service contract includes clauses specific to the confidentiality of log data.
Continuity and audit questions are covered in the AarSOC FAQ.