Security & Trust
Our architecture is built on a single, uncompromising principle: your intelligence data belongs to you, and it should never leave your network.
Data Sovereignty
Aarvi Intelligence is fundamentally designed as a self-hosted platform. Unlike SaaS competitors that pool your sensitive search queries, active investigations, and alert thresholds in a multi-tenant cloud, Aarvi runs entirely within your own Virtual Private Cloud (VPC) or on-premises data center. This deployment model ensures complete data sovereignty: if your incident response team is querying a zero-day vulnerability or a compromised executive's email, that query never traverses the public internet to our servers. Your operational security remains fully intact.
Tor-Native Collection
Scraping Dark Web forums and ransomware leak sites requires strict anonymity. The Aarvi collection engine routes all outbound collection traffic through a dedicated SOCKS5 proxy layer tied directly to the Tor network. This ensures that threat actors cannot trace collection efforts back to your organization's IP space, preventing retaliatory attacks or denial of service against your infrastructure. We continuously rotate exit nodes and user-agent strings to mimic organic underground traffic.
Logical Architecture
AI Provider Flexibility
We believe you should not be forced into a single vendor ecosystem. Aarvi's orchestration layer is entirely model-agnostic. You can configure the system to use Google Gemini, OpenAI, OpenRouter, or ZenMux for entity extraction and report generation. For organizations with strict compliance mandates prohibiting cloud LLMs, we offer Aarvi AI Nano—a highly optimized, local model that runs directly on your hardware, ensuring zero telemetry leaves your environment.
Credential & Secrets Handling
Proper security begins at deployment. All API keys, database passwords, and encryption certificates are strictly managed via environment variables (.env) or integration with your existing secrets manager (like HashiCorp Vault or AWS Secrets Manager). We maintain strict .gitignore policies and never commit configuration files to version control. The platform enforces strong cryptographic hashing for all local user accounts via bcrypt.