Architecture

How the platform is put together

Enough architectural detail to evaluate the platform properly — how the parts relate, where trust is anchored, and what depends on what. Written for the technical reader who has to sign off on a deployment.

Topology

Sensors collect. The Station correlates. The analyst decides.

Collection and analysis are deliberately separate. Sensors are built to observe and to hand over what they observed; the authoritative analysis, the case, and the evidence record live on the Lab Station.

  1. 01 Collect

    Mobile Sensor

    Android · iOS

    Records device-side observations on the handset itself.

    Guardian

    On-premise appliance

    Observes authorised network activity on a network you control.

  2. 02 Correlate

    Lab Station

    Analyst environment

    Ingests both sources into a case, correlates them, and preserves the result.

  3. 03 Decide

    Analyst

    Human judgement

    Reviews correlated findings and produces the reported conclusion.

Why the split matters

A sensor sits in the environment being observed — the least trusted place in the deployment. Keeping the authoritative case record on the analyst side means compromising a sensor does not compromise the case history, and a sensor can be replaced without the case moving with it.

Separation of concerns

Two planes, two sets of privileges

Administering an appliance and handling evidence are different activities with different risks. The platform treats them as different planes rather than as one administrative surface.

Management plane

Operating the system

Enrolment, configuration, health, software state and fleet administration. This is how an operator runs the deployment.

  • Guardian enrolment and identity
  • Configuration and operating mode
  • Health and capacity reporting
  • Software and intelligence distribution

Evidence plane

Handling case material

Acquisitions, exports, ingestion, correlation and reporting. This is where the case material actually lives.

  • Case-scoped acquisition
  • Sensor exports with integrity material
  • Verification and sealing on ingest
  • Provenance and audit

The plane a request arrives on determines what it is permitted to do — you cannot reach evidence export from the subject network. Operating an appliance and analysing case material are likewise separate privileges, held independently of one another.

Trust

Where trust is anchored

The platform distinguishes between three kinds of authority, and deliberately does not collapse them into one.

Vendor authority
Signs software releases and the integrity manifests that describe them, and signs licences issued against a Guardian ID. The corresponding private keys are held outside any deployed system — they exist on no Guardian, no Lab Station and no customer installation.
Deployment authority
Held by the customer's own Lab Station. It is the root of trust for the deployment's own material — the intelligence it distributes to its Guardians and the trust relationships within its own fleet.
Device identity
Each Guardian's own hardware-bound identity. It is what the appliance proves it is, what a licence is bound to, and what evidence is attributed to.

Verification is a signature check, not a phone call

Because verification is performed against published public keys, it works offline. A deployment does not have to reach us — or anything else — to establish that its software and its licence are genuine.

Dependencies

What needs the internet, and what does not

This distinction is load-bearing. The forensic function of the platform is designed not to depend on connectivity, so a deployment in an isolated environment is a supported configuration rather than a degraded one.

Works offline

  • Network observation and capture
  • Detection and behavioural analysis
  • Mobile Sensor collection and export
  • Case work, correlation and reporting
  • Evidence sealing and integrity verification
  • Licence verification

Benefits from connectivity

  • Software updates
  • Updated indicator sets and network-intelligence datasets
  • Support

Each of these can also be delivered out of band, for deployments that never connect.

Evidence ownership

The evidence is yours

  • Stored on your systems Captures, cases and exports are written to storage inside appliances and stations you operate.
  • No vendor route to case material The platform has no mechanism by which case material is transmitted to us as part of normal operation.
  • Exportable in open forms Evidence and reporting can be exported for use in processes that do not involve ForensicsGuard.
  • Independently verifiable Integrity can be checked against published keys, by you, without our involvement.

Take the architecture to your own review

Technical documentation covering deployment, integration and verification is available under NDA for organisations evaluating the platform.

Request a technical briefing Contact us