Enterprise Security & Architecture Protocol: CISO Whitepaper
Technical protocol distinguishing Sovereign AI client deployment capabilities from public website operations, detailing algorithmic containment architectures, standards alignment, and edge protections.
Architecture Scope & Dual-Zone Model
Air-gapped on-premise execution topology designed for enterprise clients. Configurable to operate within client corporate LAN or private VPC environments. Architecture supports local LLMs, localized script execution, and C# Revit integrations designed to operate without transmitting geometry or parameters to public AI APIs.
Hosted on Cloudflare Workers edge architecture. Public endpoints utilize Cloudflare Turnstile for privacy-preserving bot detection and Resend for transactional email notifications (Contact and ROI lead notifications).
1. Network Isolation Architecture (Zone 1 Capability)
Zone 1 Air-Gapped Execution Topology: Conceptual architecture for client-side containment of BIM geometry and algorithmic workflows within a corporate LAN perimeter.
2. Standards & Technical Alignment Matrix
| Framework / Standard | Security Objective | pyBIM Technical Implementation Capability |
|---|---|---|
| ISO 19650-5 (Information Security Principles) | Metadata leakage prevention & model security | Designed for offline LLM deployment and localized model execution within customer-controlled environments or encrypted CDEs. |
| UNI 11337 (Digital Management) | Sovereign BIM data management | Automation scripts capable of executing directly against local Revit files without cloud geometry extraction. |
| GDPR (EU 2016/679 Principles) | Data minimization & local custody | Sovereign nodes operate in isolated networks. Public website collects minimal voluntary inquiry data with published retention practices. |
| Bilateral NDA & Confidentiality | BIM project data privacy & CDE integrity | Client Revit models and IFC files managed through agreed CDE channels with data handling governed by bilateral contracts. |
3. Sovereign AI Data Custody Architecture
SOVEREIGN AI CLIENT DEPLOYMENTS NOTICE
"For client sovereign edge AI deployments, pyBIM architectures are engineered to eliminate background telemetry. In this configuration, proprietary BIM geometry, structural parameters, and algorithmic logic are retained within the client firewall rather than transmitted to third-party public AI APIs."
EPHEMERAL RAM LIFECYCLE (ZONE 1 CAPABILITY)
RAG pipeline embeddings and intermediate calculation vectors are held in ephemeral memory and discarded upon script completion. Persistent model state remains under the custody of the client's Common Data Environment (CDE).
4. Security Engineering & Infrastructure Protocols
GPU-VPS Sector (Private Plugins)
- Drive Encryption SupportSupports AES-256 at-rest disk encryption and secure boot on client-designated private VPS instances.
- Secure Networking TunnelsConfigurable for administrative access via authenticated WireGuard or Tailscale tunnels, dropping unauthenticated traffic.
Edge Appliance Sector (Sovereign AI)
- Hardened OS ArchitectureSupports hardened Linux environments with mandatory access controls such as AppArmor or SELinux.
- Hardware Isolation CapabilityCan be deployed on headless on-premise hardware with unused physical I/O ports disabled at BIOS level where required.
Public Web Sector (Cloudflare & Edge)
- Edge Delivery & TurnstilePublic website served globally via Cloudflare Workers serverless edge. Cloudflare Turnstile provides bot defense without tracking cookies.
- Transactional Email (Resend)Contact submissions and ROI lead notifications dispatched via Resend TLS-encrypted transactional APIs with payload validation.