Security & Architecture

Cloudflare Enterprise Edge Defense & Network Perimeter

Every network transaction directed to GattAI is defended by Cloudflare’s global Anycast edge network spanning over 330 cities worldwide, with proximate Tier-1 edge data centers in Dubai (DXB) and Abu Dhabi (AUH). Unmetered multi-terabit perimeter protection halts malicious traffic before it can reach core platform infrastructure.

Cloudflare Anycast Edge & Regional Ingress

Sub-millisecond edge termination in the UAE (Dubai DXB / Abu Dhabi AUH PoPs). Anycast routing distributes traffic dynamically across hundreds of edge locations, insulating origin infrastructure from localized network congestion and packet loss.

Unmetered Layer 3, 4 & 7 DDoS Mitigation

Continuous, autonomous mitigation backed by over 300 Tbps of edge capacity. Volumetric SYN floods, UDP reflection amplification, and complex Layer 7 HTTP application floods are neutralized at the edge with zero latency penalty for verified enterprise traffic.

Cloudflare Web Application Firewall (WAF)

Enterprise WAF rulesets incorporating OWASP Top 10 protection, machine-learning threat intelligence, and zero-day virtual patching. Malicious vectors, including SQL injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), and remote command injection, are inspected and blocked before reaching our application gateway.

Strict TLS 1.3 & HSTS Preloading

All communication enforces TLS 1.3 with modern authenticated ciphers (ChaCha20-Poly1305 and AES-256-GCM) and Perfect Forward Secrecy (PFS). HTTP Strict Transport Security (HSTS) with max-age preloading guarantees zero protocol downgrades or unencrypted sessions.

Cloudflare DNSSEC Validation

Domain Name System Security Extensions (DNSSEC) cryptographically sign and authenticate all DNS records for our domains, preventing DNS poisoning, BGP route hijacking, and man-in-the-middle domain spoofing.

Cloudflare Zero Trust (ZTNA / Access)

Administrative interfaces, staging clusters, and telemetry pipelines are concealed behind Cloudflare Zero Trust Network Access. Access mandates hardware-backed FIDO2 / WebAuthn MFA, enterprise identity verification, and continuous device posture checks.

Intelligent Bot Management & Rate Limiting

Behavioral bot scoring distinguishes legitimate browser sessions and search indexes from automated scraping, credential stuffing, and brute-force probing targeting authentication and waitlist APIs.

Data Handling & Defense-in-Depth Encryption

Human Resources records contain an enterprise’s most confidential personal, financial, and organizational assets. GattAI treats every individual data point as an asset to isolate within strict tenant boundaries, not a commodity to circulate across microservices.

Field-Level Envelope Encryption

High-risk personal fields, including national identification numbers (Emirates ID, Passport numbers), bank account IBANs, base compensation, bonus structures, and confidential health records, are encrypted individually at the application layer using AES-256-GCM envelope encryption. Storage-level access yields only ciphertext without the customer-isolated Data Encryption Key (DEK).

Encryption in Transit & at Rest

All internal network communication requires TLS 1.3 with Perfect Forward Secrecy. Database volumes, read replicas, Redis caches, and document stores utilize full-disk AES-256 encryption managed via cloud Key Management Services (KMS) with automated key rotation.

Isolated Document Storage

Employee contracts, identification scans, and payslip PDFs are isolated in private object storage partitions with public access blocked at the bucket level. Access is granted exclusively through short-lived, cryptographically signed URLs (15-minute expiration) logged on every request.

Ephemeral Tokenization

In-flight data transformations sanitize identifiers into ephemeral memory structures that exist only for the duration of the operational request before being cleared from memory buffers.

Zero-Trust Access Control & 13-Role RBAC

Access is denied by default across every API endpoint and data tier. Permissions are granted explicitly per object and tenant, ensuring that organizational hierarchy strictly dictates visibility.

13 Defined Operational Roles

Granular role-based access control (RBAC) spans thirteen discrete system personas: Super Admin, HR Director, HR Manager, HR Specialist, Recruiter, Payroll Specialist, Performance Manager, Department Head, Direct Manager, Employee, External Auditor, Compliance Officer, and Candidate. There is no implicit privilege inheritance that silently broadens access.

Row- & Object-Level Authorization

Authorization evaluates dynamically on every database query. Being assigned a role that oversees certain requisitions or department reviews does not provide traversal access to unassigned records or executive salary bands.

Strict Employee Self-Service Scope

Employees can view only their personal profile, assigned objectives, submitted leave requests, and issued payslips. The employee role possesses zero query vectors to inspect peer files or organizational compensation tables.

Enterprise IAM & Mandatory MFA

Native integration with enterprise identity providers via SAML 2.0 and OIDC (Okta, Microsoft Entra ID, Google Workspace). Multi-Factor Authentication (MFA / TOTP or FIDO2) is enforced on all administrative, HR, and payroll roles.

The AI Data Pipeline & Cryptographic Isolation

External Large Language Models never encounter real employee or candidate identities. Before any inference request leaves the platform boundary, our deterministic pseudonymization module sanitizes all direct and quasi-identifiers.

Deterministic Pseudonymization

Before an external API call is dispatched, names, emails, phone numbers, employee IDs, and national identifiers are replaced with ephemeral cryptographic tokens (e.g., [CANDIDATE-7A2F], [EMPLOYEE-9C04]).

Encrypted Pseudonym Mapping

The mapping table resolving tokens back to real human identities is encrypted with tenant-specific keys, confined inside the customer database partition, and never transmitted in prompt payloads.

Stateless Text-In, Text-Out Execution

Models operate in strict text-in, text-out isolation. Inference endpoints have no external network egress, no tool-calling access, and no connection to underlying relational databases.

Prompt Injection Defense & Delimiter Sandboxing

Untrusted input text, such as applicant resumes, uploaded case studies, and free-form review comments, is sandboxed within XML/Markdown boundary delimiters and parsed strictly as untrusted data, neutralizing prompt injection attacks.

Zero Data Retention (ZDR)

All enterprise model invocations operate under binding commercial Data Processing Agreements (DPAs) with zero data retention. Customer data is processed ephemerally in RAM and is contractually prohibited from being used to train or fine-tune public foundation models.

Tamper-Evident Hash-Chained Audit Trail

Every consequential event across the platform generates an immutable audit record. Audit logs are cryptographically hash-chained: each log entry embeds the SHA-256 hash of the preceding entry, meaning any retrospective deletion, reordering, or modification breaks the cryptographic chain and triggers an alert.

Cryptographic Chain Verification

An altered or deleted log entry immediately invalidates all subsequent block hashes. Compliance officers and independent auditors can run automated integrity checks to mathematically verify that the record has not been altered since generation.

Exhaustive Event Coverage

The audit log captures role and permission changes, compensation adjustments, document downloads, workflow approval actions, and full AI execution telemetry (prompt version, input snapshot, model ID, execution cost, and approver signature).

SIEM & Log Forwarding

Structured audit events can be streamed directly in standard JSON/Syslog formats to enterprise Security Information and Event Management (SIEM) systems such as Splunk, Datadog, or Microsoft Sentinel.

Cloud Infrastructure, UAE Data Sovereignty & Regional Resilience

GattAI is deployed on secure cloud infrastructure designed for maximum availability, strict network segregation, and full compliance with UAE sovereign data residency laws.

UAE Sovereign In-Country Data Residency

To comply with UAE Federal Decree-Law No. 45/2021 (PDPL) and public-sector procurement standards, GattAI provides dedicated hosting in sovereign cloud data centers inside the United Arab Emirates (AWS Middle East UAE region and Microsoft Azure UAE North / Central regions in Dubai and Abu Dhabi).

Dubai Electronic Security Center (DESC) Standards

Platform architecture adheres to the Dubai Information Security Regulation (ISR) baseline and Cloud Security Standard for enterprise and government entities in the Emirate of Dubai.

VPC Isolation & Private Subnets

All database clusters, Redis queues, and background worker pools reside within private subnets with no public internet ingress. Ingress traffic routes strictly through Cloudflare edge tunnels and authenticated reverse proxies.

Business Continuity & Disaster Recovery

Automated daily encrypted database backups replicated across multiple availability zones within the UAE. Recovery Point Objective (RPO) is under 1 hour; Recovery Time Objective (RTO) is under 4 hours.

Certifications & Vulnerability Management, Stated Honestly

We publish our precise operational posture openly. SOC 2 Type II and ISO/IEC 27001 certifications are actively scheduled on our pre-launch security roadmap; we state our controls factually today rather than make claims before formal attestations are issued.

Automated Vulnerability Scanning

Continuous Static Application Security Testing (SAST) and Software Composition Analysis (SCA) run across all code repositories on every pull request to identify vulnerable dependencies.

Independent Penetration Testing

Third-party security firms conduct annual grey-box and black-box penetration tests against our application endpoints, APIs, and cloud configurations prior to commercial GA.

When third-party audit reports are completed, attestations and SOC 2 Type II reports will be available for download under NDA directly within this Trust Center.