Technology › Security & Compliance
CNLab is built on four principles: defense in depth, least privilege, encrypt everywhere, and full auditability. Every claim below maps to a control your CISO can verify.
Network, host, container, and application controls. No single layer is trusted alone.
Default-deny RBAC. Quotas. Per-namespace network policies. Nothing reaches more than it must.
At-rest LUKS, in-flight TLS 1.3, cross-cloud WireGuard or PrivateLink. Keys rotated on schedule.
Append-only log of every privileged action. Exportable to your SIEM. 90-day default retention.
Disk encryption via LUKS (on-prem) or provider-managed KMS (cloud). Volume keys rotated quarterly. Backup encryption with envelope keys held off-cluster.
TLS 1.3 mandatory for all API and admin traffic. mTLS between platform components. Cipher suites limited to FIPS-approved algorithms.
WireGuard tunnel by default. AWS PrivateLink, GCP Interconnect, Azure ExpressRoute supported for production tier. No traffic over public internet for sensitive workloads.
VISITOR · USER · EDITOR · ADMIN · SUPER_ADMIN. Permissions are resource:action keys (e.g. servers:write). Custom roles supported.
Each project gets its own Kubernetes namespace, VRAM quota, storage quota, and network policy. Cross-project pod traffic denied by default.
When tenant boundaries must be hardware-strong (e.g. customer A vs customer B on a shared cluster), MIG slices give per-instance memory bandwidth + fault isolation.
Secrets encrypted at rest, decrypted only into the running pod's memory. SSH keys rotate on every session. SealedSecrets in GitOps mode.
Every privileged action: actor, action, resource, before-state, after-state, IP, user agent, timestamp.
90 days hot in PostgreSQL. Monthly export to cold storage (S3 Glacier or on-prem object). Configurable per-tenant.
CSV download (admin UI) or webhook to your SIEM (Splunk, Sumo, Elastic). Format: CEF or JSON.
Roadmap: Type I attestation H2 2026; Type II by Q1 2027. Controls already implemented; observation window underway.
Stage 1 audit complete. Stage 2 scheduled Q3 2026. ISMS in operation.
Targeted Q4 2026 — required for Korean public-sector procurement.
Send it. Our security team responds with line-by-line answers within three business days. Common templates (HIPAA, FedRAMP-aligned, K-ISMS) pre-mapped.