Security First Architecture

Built for the safe detonation of zero-day malware.

Isolation Layers

gVisor (runsc) Sandbox

  • User-space kernel isolation
  • System call interception
  • Container-level security

Firecracker MicroVMs

  • Hardware-level KVM isolation
  • Millisecond startup times
  • Minimal attack surface

Kata Containers

  • Lightweight VMs as pods
  • Seamless Kubernetes integration
  • Strong workload isolation

Network Simulation

  • Fake DNS resolution (INetSim)
  • Simulated C2 responses
  • Complete PCAP traffic capture

Data Ephemerality

  • Wiped securely post-analysis
  • No persistent workload storage
  • Stateless execution nodes

Data Protection

AES-256 Encryption

All data at rest is encrypted using industry standard AES-256 encryption. Keys are managed securely.

TLS 1.3 In Transit

All communication between components, internal services, and external APIs is strictly enforced over TLS 1.3.

MinIO Object Storage

Malware payloads are stored in S3-compatible MinIO using SHA256 content-addressable storage to prevent tampering.

Immutable Audit Logging

Structured JSON audit logs (via structlog) track all API and control plane operations for compliance and forensic analysis.

RBAC Authorization

Granular Role-Based Access Control enforced via Supabase JWTs, ensuring tenant data remains strictly isolated.

Pod Security Standards

All platform components run with readOnlyRootFilesystem, runAsNonRoot, and cap_drop: ALL enforced via Kubernetes admissions controllers.

Kubernetes Native Security

Namespace Isolation

The control plane, database layer, and sandbox detonation engines are separated into distinct Kubernetes namespaces with explicit RBAC boundaries.

Network Policies

Strict Calico network policies enforce zero-trust communication. Sandbox pods can only communicate with the telemetry collector and are blocked from internal cluster access.

Tainted Node Pools

Detonation pods (Firecracker/Kata) are scheduled exclusively on dedicated, tainted node pools physically separated from the API and intelligence layers.

Threat Model & Flow

User
↓
API Gateway (JWT Auth)
↓
MinIO Storage (Encrypted)
↓
Sandbox Engine Selector
↓
Air-Gapped Execution (gVisor/Firecracker)
↓
Redis Telemetry Collector
↓
Intelligence Layer & Neo4j
↓
Encrypted Report Storage

Responsible Disclosure

We take security seriously. If you find a vulnerability, please report it directly to our security team.

security@acros.io
Return Home