— SECURITY · 02 OF 07 · TENANT BOUNDARIES

Five layers of isolation.
Each one auditable.

Data isolation isn’t a single feature — it’s a property of every layer. We enforce tenant boundaries at storage, compute, memory, model context, and audit-log level. Yeh page describes each layer, what enforces it, and how you can verify.

BOUNDARY LAYERS5 (storage/compute/memory/model/log)
CROSS-TENANT TRAININGNever
VERIFY METHODCustomer-readable audit log
ENFORCEMENTHypervisor + IAM + KMS

01The five layers.

L1 · STORAGEPer-VM block storage · encrypted at rest with per-customer KEK; physically distinct logical volumes; daily snapshot scoped per VM.enforced at hypervisor
L2 · COMPUTEVM-level isolation · the Cyborg runtime runs on hardware-isolated vCPUs allocated to your VM; no process-level co-tenancy.enforced at hypervisor
L3 · MEMORYVM-private RAM · the Cyborg’s working memory + indexes live in your VM’s RAM; never paged to shared swap; cleared on reboot per spec.enforced at hypervisor
L4 · MODEL CTXStateless inference · prompts go to a stateless GPU pool; no per-request retention; no cross-customer fine-tune; verified contractually with model providers.enforced at IAM + DPA
L5 · AUDIT LOGPer-customer log streams · every action emits to your customer-side log sink; the streams are scoped to your tenant by signed JWT; no cross-tenant join possible.enforced at JWT scope

02What we never do.

  • Never train shared models on your data. Customer data is not used to fine-tune any model that another customer benefits from. Aggregated, fully-anonymised metrics for platform improvement are permitted only where re-identification is mathematically impossible.
  • Never combine prompt context across customers. Each inference call carries one customer’s context. The GPU pool sees the prompt, returns the completion, drops the context immediately.
  • Never allow cross-tenant lookups. The runtime cannot retrieve data from another customer’s VM — no API exists, no bypass exists. This is enforced at IAM level and double-enforced at network level.
  • Never silently log customer content for “debugging”. When Aliens engineers need to debug an incident, customer content is read only via the break-glass approval workflow. You see it, in real-time.

03How you verify.

Trust requires verifiability. Every claim above can be checked from your dashboard:

  • Audit log export · download every action your Cyborg performed in the last 90 days. JSON format, includes API calls, scopes used, response codes.
  • Egress proxy log · every outbound API call leaves a record (URL, method, response code, byte count) — visible per-VM.
  • Inference call audit · per-call record of the model used, timestamp, success/failure, latency. Content of the prompt is hash-only, not stored, but the metadata is kept.
  • Annual third-party audit · from Q3 2026, ISO 27001 + SOC 2 Type II reports available under NDA.

04Edge cases.

Shared infrastructure exceptions: Cloudflare CDN, DNS resolution, and certain logging aggregators are shared infrastructure. None of them carry decrypted customer payloads — only metadata (URL paths, IP addresses, timestamps).

Sub-processor data flows: When the Cyborg makes an authorised call to a third-party tool (Slack, GitHub, etc.), data leaves the VM by your authorisation. Sub-processors are listed in the DPA.

Backup region replication: Backups stay in-region by default. For Enterprise customers requesting cross-region DR, a separate DR addendum applies and is logged in your audit trail.