🛡️ 1. The Zero Egress Guarantee
At AIPrunr, we believe the best way to protect your cloud infrastructure data is to never let it leave your network border.
AIPrunr executes 100% locally inside your AWS VPC, GCP Project, Azure Subscription, or VMware vSphere cluster. All credentials, flow logs, cost metrics, and infrastructure topologies remain strictly air-gapped on your dedicated appliance. Zero outbound data egress.
🔒 2. Data Sovereignty & Zero Telemetry
Traditional SaaS FinOps tools ingest and store your internal network topology, IP addresses, and billing records on shared third-party cloud servers. AIPrunr guarantees complete local sovereignty:
- • Local Storage Only: All forensic databases reside exclusively on the encrypted disk volume of your local appliance.
- • Zero Phone-Home Telemetry: The appliance contains zero tracking scripts, telemetry agents, or crash reporting backdoors calling AIPrunr HQ.
- • On-Demand Purge: InfoSec administrators can execute a 1-click full cryptographic data purge directly from the local console.
🔑 3. Military-Grade Encryption
We enforce rigorous cryptographic standards across all storage and communication vectors:
- • Encryption at Rest: Cloud credentials and API tokens are encrypted using AES-256-GCM with hardware KMS envelope integration before writing to disk.
- • Encryption in Transit: The command center web interface is served strictly over TLS 1.3 / HTTPS with HSTS enforcement. All cloud API queries use TLS-encrypted sockets.
📋 4. Least-Privilege Read-Only IAM Model
AIPrunr operates strictly under a 100% Read-Only IAM Policy. We never require write, modify, or delete permissions on your production workloads.
Sample Standard AWS Read-Only Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AIPrunrForensicRead",
"Effect": "Allow",
"Action": [
"ce:GetCostAndUsage",
"ec2:DescribeInstances",
"ec2:DescribeVolumes",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeFlowLogs",
"rds:DescribeDBInstances",
"s3:ListAllMyBuckets"
],
"Resource": "*"
}
]
}
📜 5. Enterprise InfoSec Review Pack
To streamline enterprise procurement and vendor security clearance, we provide a pre-packaged Security Review Dossier available under NDA:
- ✅ SIG Lite Questionnaire: Pre-filled 120-question InfoSec audit document.
- ✅ SOC 2 Type II Evidence Alignment: Comprehensive control mapping for your auditors.
- ✅ ISO 27001 ISMS Blueprint: Complete security management documentation.
- ✅ Flow Log Forensics Architecture: Deep-dive network packet header spec.
Request InfoSec Security Pack →
📦 6. Vulnerability & SBOM Transparency
AIPrunr enforces rigorous software supply chain security:
- • Automated SBOM: Every appliance release ships with a signed Software Bill of Materials (SPDX JSON format).
- • 48-Hour Patch SLA: Critical CVE vulnerabilities in underlying OS binaries are patched within 48 hours of public disclosure.
🏰 7. Air-Gapped Deployment Packages
Deploy seamlessly into your preferred infrastructure topology:
VMware vSphere OVA
Pre-configured Linux Virtual Appliance for ESXi clusters.
Kubernetes Helm Chart
Single-command deployment to EKS, GKE, or AKS clusters.
📐 System Architecture Blueprint
Explore our detailed forensic pipeline, flow log ingestion engine, and air-gapped database layer in our official architecture blueprint.
View Architecture Blueprint →