The appliance every product runs on
Security that comes from the structure
| Layer | What it does |
|---|---|
| Physical isolation | A switch inside the appliance joins one network at a time and fully disconnects the first before joining the other. At every start everything is disconnected first, and the disconnected state is proved by the switch's own feedback, not by a command having run. |
| Trusted start | UEFI Secure Boot, the boot measured into a TPM 2.0 chip, and a read-only system verified block by block with dm-verity. The boot chain is built once and is the same on every unit. |
| Data at rest | Encrypted from the first start with LUKS2 and AES-256-XTS. The key is released only to a start signed by the vendor, and the recovery secret is shown once, to the person commissioning the unit. |
| Isolated inspection | The programs that open files, and the inspection engines, run in rootless containers with AppArmor, seccomp, no network, a read-only root and resource limits. Any failure keeps the way through closed. |
| Cryptography | Signatures with ECDSA over P-256 and SHA-256, TLS 1.3 only, AES-256-GCM, passwords with Argon2id. MD5, SHA-1, 3DES, RC4 and TLS 1.2 or older are never used. |
| Identity and audit | A password, asked again for high-risk actions; no hidden vendor account or key. The audit trail is append-only and tamper-evident. |
Intelligence on the appliance
Bardin Gate does more than enforce rules: it understands what crosses. Everything below runs on the appliance itself, offline, and works for the boundary, never around it.
| Capability | What it does |
|---|---|
| Content understanding | Every file is judged by its real bytes, not by its name or the sender's claim: its true type, hidden active content such as macros and scripts, dangerous archives, and sensitive data. |
| AI inspection | An AI model on the appliance examines what the fixed rules let through and stops what looks malicious or out of place. It can hold a file back; it can never let one through. |
| Anomaly detection | The appliance learns each flow's normal pattern, its volume, timing, file types and sources, and raises an alert in the console and in your SIEM when a crossing departs from it. |
| Policy assistant | An administrator describes in plain words what should cross, and the assistant drafts the rules and the policy. Nothing takes effect until a person reviews and approves it, as a new, audited version. |
| Decisions with reasons | Every outcome is recorded with the evidence behind it and the version of each rule, engine and model that produced it. |
The rules the model keeps
- On the appliance, offline. The model runs inside the appliance's isolated inspection, with no network and no outside service.
- Evidence, never the last word. A person, or a policy you approved, decides; the model adds evidence to that decision.
- Silent to the sender. Its findings never go back to the side a file came from.
- On record. Each finding is in the audit trail with the model's version.
- Updated like signatures. New models arrive signed and offline, in the data-only package that never changes the software.
Identity and access
- The appliance is the only authority. The browser, imported files and everything else bring claims; none of them can grant authority.
- The default is deny. Roles carry an explicit scope, and a permission that is not written is a refusal.
- The password, and the password again. Roles, security policy, licence and update import, time correction, recovery and configuration import ask for it again.
- No back door. There is no vendor master password, hidden account, email reset or unaudited bypass. Recovering the last administrator is a physical procedure at the unit.
- SSH reaches only a restricted support account. It returns reports, logs and status and nothing more. Root has no SSH login, and there is no routine shell or direct database access.
Audit and SIEM
| Property | Value |
|---|---|
| Tamper evidence | Each event is chained to the hash of the previous one; a segment closes at 10,000 events or after an hour, and its checkpoint is signed. |
| What is recorded | Every security, administrative and business-critical attempt and outcome, including refused high-risk actions. |
| Trusted time | Kept by the appliance itself, offline; a clock anomaly cannot extend a licence or a retention deadline. |
| SIEM | A one-way export of structured events: TCP over TLS by default, optional mutual TLS, RFC 5424 JSON or CEF, with addresses pseudonymised. |
| Never exported | File content, credentials, tokens and private keys. |
What you receive and what you provide
| Item | What it means |
|---|---|
| The appliance | A 2U rack-mount appliance, ready as delivered. There is no server, operating system or extra software to choose or install. |
| Space and power | 2U of space in a standard rack, and power. |
| Network | A connection to the Safe, Unsafe and management networks. The first two are never joined to each other. |
| Day to day | Just a browser. The console speaks fourteen languages. |
| Internet | Not needed. Licences, updates and signatures arrive offline and signed. |
Up and running in four steps
Rack it
Mount the appliance and connect power and the Safe, Unsafe and management networks.
Open the console
Open it in a browser. A code on the appliance's own display proves that you are standing at the unit.
Follow the guided setup
The steps run in order and each one tests itself: hardware, time, network addresses and the first administrator.
Accept it
Take the signed commissioning evidence. The appliance is ready for work.
Updates that cannot leave you stranded
- Packages are signed and offline. A package without a valid signature, or older than the release already installed, is refused.
- Two slots. An update is written to the other slot, started once as a trial, and kept only after health checks pass; otherwise the unit falls back to the previous version by itself.
- Data is separate from software. Engine signatures, AI models, rules and validation schemas arrive in a data-only package that never changes the software.
Self-repair and recovery
The appliance assumes that nobody can reach it, so it repairs itself. It has no keyboard, screen session or routine shell, and no recovery path requires reaching a failed unit.
| Situation | The right path |
|---|---|
| Software no longer healthy | A soft reset returns it to the last known good state; identity, configuration, logs and audit survive. |
| One disk fails | Replace it by the runbook; the volume stays healthy or recoverable. |
| Power supply or fan | The vendor's procedure under maintenance, then a readiness check. |
| Motherboard or security chip | The appliance asks for the recovery secret once, at the unit, and keeps its identity, configuration and licence. |
| The whole appliance is lost | A replacement: fresh commissioning, the configuration imported, secrets entered again. The old identity is never cloned. |
Talk to our specialists
Tell us about your environment and what you need. One of our specialists will answer you.