OwnNetInfrastructure Ltd.
Subscriber Portal
Security

End-to-end encryption architecture

Telemetry is encrypted from the agent process to the tenant store. Gateways operate on authenticated envelopes, never on plaintext payloads, and no telemetry content is written to logs at any hop.

TLS 1.3 everywhere

Agent-to-gateway and gateway-to-store links negotiate TLS 1.3 only, with X25519 key exchange and AEAD ciphers. TLS 1.2 and downgrade paths are disabled at the listener.

AEAD · HSTS · OCSP stapling

Zero Persistence Logging

Access logs record tenant, node, request class and outcome — never payload content, header values or metric bodies. Log retention is fixed at 30 days and not tenant-configurable upward.

Metadata only · 30-day retention

EU regulatory alignment

Processing and storage remain inside the EEA. Data processing agreements, sub-processor registers and incident notification timelines are maintained against GDPR and NIS2 obligations.

GDPR · NIS2 · EEA-only

How a frame is protected

Four layers, each independently verifiable by the receiving party.

  1. Transport. The agent completes a TLS 1.3 handshake with a gateway certificate pinned to the OwnNet root.
  2. Identity. A short-lived tenant token (15 min TTL) is presented with mTLS; the gateway validates scope before reading the frame.
  3. Envelope. The payload is sealed with AES-256-GCM under a per-tenant data key derived from the tenant KMS root.
  4. Store. The sealed envelope is written to a tenant-scoped bucket with an immutable audit entry.
ingest handshake — observed sequence
# gateway log excerpt (metadata only)
TLS    tls1.3  cipher=TLS_AES_256_GCM_SHA384  kex=X25519
AUTH   tenant=acme-eu-prod  scope=ingest:write  ttl=900s
FRAME  class=metrics  seq=184423  bytes=4096  sealed=aes-256-gcm
STORE  bucket=tenant/acme-eu-prod  object=2026/11/11/184423  ack=ok
# payload content is never logged

Controls and attestations

Control area Implementation Evidence
Encryption in transit TLS 1.3, HSTS, pinned roots Quarterly scan report
Encryption at rest AES-256-GCM envelope, per-tenant keys KMS key policy export
Access control Scoped short-lived tokens, mTLS, RBAC Access review log
Logging Zero persistence of payload content Log schema definition
Incident response 24 h notification to affected tenants Runbook and drills
Sub-processors EEA-only, published register DPA annex

SOC 2 Type II is in progress; the current report is available under NDA. Requests for security questionnaires go to support@ownnet.club.

Request the security pack

Architecture summary, DPA, sub-processor register and questionnaire responses.

Contact security team