Bardin Gate ART
Content assurance and the Agent's own security
From claim to evidence, before any delivery
ART never accepts that a file is what it is said to be. Every claim from the Agent, every file and every piece of metadata is treated as hostile. A claim can only reject the plainly forbidden early; the appliance always makes the final ruling on the bytes it stored, with named evidence and named versions.
Integrity
SHA-256 is computed again on the stored file.
Observed facts
Size, type, archive and document structure are read once and shared by every check.
Declared against observed
A mismatch is evidence; a claim never overrides what was observed.
Validation
Rules for names, types, archives, PDF and Office documents, and structured data such as JSON, XML and CSV.
Inspection
ClamAV and YARA, each in an isolated worker.
Policy
Only policy decides: allow, reject, quarantine or approval.
Rules and engines only gather evidence. Policy alone decides, and only the transfer's own fixed process changes its state, so no scanner, file reader or interface can declare a file clean on its own.
Anything unknown stops the transfer
| Situation | Behaviour |
|---|---|
| An engine is unavailable, crashed, timed out or answered malformed | Indeterminate; the transfer does not move on |
| Required evidence is missing or its version unknown | Refused, never a silent pass |
| An archive or resource limit is exceeded | Refused, with no unsafe extraction |
| A definite malicious finding | Quarantine; never retried with a weaker tool |
The sender gets the outcome and a reference code. Only an authorised role looks up the evidence by that code in the console, so the answer does not teach an attacker what passes.
The Agent is a boundary of its own
| Area | How it is protected |
|---|---|
| Key and identity | The Agent's key is made on the computer itself and kept in the system's secure store where there is one. Enrolment needs a certificate request and an administrator's explicit approval; installing the Agent does not approve it. |
| Local copy | Each user's copy is encrypted with a key held by the system's secure store and isolated from other users of the same computer. |
| Channel | TLS 1.3 with identity on both sides. Each Agent host has its own revocable certificate; a host name or IP address is never an identity. |
| The file | Regular files only, links not followed; hashed at source and in the spool, published in one step at a fixed root and read back. |
Talk to our specialists
Tell us about your environment and what you need. One of our specialists will answer you.