TLP:CLEARREF #CYN-6106SELF-HOSTED CTEM // ZERO EGRESSEN / عربي — RTL NATIVEUTC --:--:--
Don't trust us. Verify us.
A security product sold to skeptical technical buyers should expect to be audited. This page is written for that audit — the architecture, the data flow, the security posture, the continuity plan, and, deliberately, the list of things we don't do yet.
Single-tenantSelf-hostedZero-egress by designNo certifications yet
Cyntelligence is single-tenant and self-hosted. Everything runs on one host you control: the web application, two background workers, PostgreSQL, Redis, and a local LLM runtime serving the AI on your own GPU. Threat data, case evidence, org profiles, and prompts are stored in your database and processed on your hardware. There is no Cyntelligence cloud in the data path — no vendor servers to trust, and none to fail.
↗ Outboundyou configure it
Threat & vulnerability feeds you enable
Certificate-transparency lookups (carry the brand keyword being searched)
Ransomware leak-site monitors
Code & breach sources
Every source is individually configurable. An air-gapped deployment can disable collection entirely and run on imported data.
⦸ Never outboundby architecture
AI prompts & answers — inference runs on your GPU
Case evidence, findings, your org profile
The agent audit ledger, credentials, reports
Usage telemetry — no beacon, no phone-home, no crash reporter
A normal page view makes zero external requests — even fonts and scripts are served from your host.
Verify it yourself — don't take the diagram on faith
This panel simulates exactly what your egress firewall would see during a POC. Toggle what the analyst does; watch what leaves the host.
devtools · network — host egress monitor
Analyst actions (local)
Collection sources (outbound — you enable these)
No traffic yet — trigger an action above.
0 EXTERNAL REQUESTS0 local · 0 outbound
Count the requests
Open devtools on any product page and count external requests. The number is 0.
Watch inference
Put tcpdump on the host, run an AI analysis, a triage, a brief. Outbound traffic during inference: none.
Diff the sockets
The outbound connections you do see match your enabled collection sources, one-for-one.
02 — Security posture
A threat-intel platform is itself a target.
It holds the map of your weaknesses. This is how the product protects what it knows.
ID
Identity & access
RBAC with per-module permissions, TOTP 2FA with encrypted secrets, login lockouts, brute-force protection and session hardening.
◱
Application surface
The listener binds to loopback, reached only through your TLS termination. Strict CSP and security headers ship by default; assets are self-hosted.
▤
Data handling
TLP/PAP enforced through the product — including on exports. Org-scoped isolation at the query layer; provenance recorded on findings, briefs and answers.
AI
AI governance
Every autonomous action is logged: what it did, on what evidence, with what model, and whether it held up. Autonomy is earned through calibration, never default.
◉
Observability
Health endpoints per process, Prometheus-compatible metrics, structured JSON logs with request tracing, worker heartbeats, and data-quality canaries for stale feeds.
⟲
Backup & recovery
Scripted nightly dumps to an offsite target you configure, plus a scheduled restore-test path. A backup that's never been restored is a hope, not a backup.
COMPLIANCE POSTURE, STATED CAREFULLY — we hold no certifications yet. The platform is architected for data-residency and sovereignty: single-tenant, self-hosted, zero-egress. This model supports obligations under GDPR · Saudi NCA ECC · UAE IA · India CERT-In — outcomes depend on your deployment and processes. We provide the architecture documentation to support your assessment. We won't use the word "compliant" until an auditor can.
03 — Deployment
If you can run a hypervisor, you can run this.
🗔
Docker Compose (Linux)
The recommended path. One command brings up every service on a fresh host — database, cache, LLM runtime, web, workers — with healthchecks, auto-restarts, and migrations run for you.
⊞
Windows Server services
For Windows-only shops: the same stack as native Windows services with auto-start, dependency ordering, and a scripted install/uninstall path.
▣
What you provide
One server you control — a modern multi-core CPU, RAM for PostgreSQL and Redis, SSD storage, and, honestly stated, a GPU for the local LLM. Reference specs sized to your environment in the POC.
04 — Continuity & the bus factor
Built by one engineer. The fairest objection there is.
"What happens to us if something happens to you?"
Here is the answer we'd want if we were buying. Self-hosted software keeps running on your hardware regardless of vendor events. Your deployment, database, and collected intelligence do not depend on our servers staying up — there are none in the data path. Compare honestly: a SaaS vendor's outage takes the product with it, that day.
Source-code escrow (Assured tier)
A defined vendor-failure event gives your organization access to the code that runs your deployment. Escrow mechanics are agreed per contract, in writing, before you depend on us.
Documentation depth
Because one person must operate, debug and rebuild everything, the platform is documented unusually deeply — topology, runbooks, health checks, recovery. It ships with the product, not just with the builder.
Support SLA — direct to builder
The person answering your ticket wrote the code. Assured-tier response and escalation terms are in the contract — ask for the current SLA summary and hold us to it.
05 — What we don't do (yet)
If one of these is your hard requirement, we'd rather lose the deal than your trust.
No
No proprietary HUMINT or primary dark-web collection
We ride open-source intelligence, community feeds and your own data — and operationalize them well. We don't run undercover analysts or proprietary collection like the enterprise vendors. If finished intelligence from primary sources is your requirement, we're not that vendor, and we won't pretend to be.
Roadmap
STIX/TAXII ingest
Today Cyntelligence exports STIX 2.1, MISP-compatible feeds, and Sigma/Snort/Suricata rules — it does not ingest STIX/TAXII. Bi-directional ingest is on the roadmap, not shipped. If two-way ISAC sharing is a day-one requirement, we're not your tool yet.
Roadmap
No prebuilt SIEM/SOAR connectors yet
Detections export in standard formats your SIEM already understands (Sigma, Snort, Suricata, STIX, CSV) — but there's no library of one-click vendor connectors. Integration today is via exports and the API.
Waitlist
Single-org architecture
Built and tuned for one organization per deployment. Multi-org isolation exists, but MSSP-grade multi-tenant scaling degrades data freshness past a handful of tenants — which is why the MSSP tier is waitlist-only until the hardening is real.
Real cost
A GPU is a genuine requirement
Local AI means local hardware: the LLM needs a GPU on your host. It's a one-time capex line that replaces every per-token fee forever — but it is not zero, and the reference spec is honest about it.
No
No certifications yet
We hold no SOC 2, ISO 27001, or regional certification today. The architecture is built to make your compliance case easy to assess — single-tenant, self-hosted, zero-egress — and we provide the documentation to support it.
WHAT THIS POSITIONING IMPLIES, PLAINLY — Cyntelligence is an operationalization engine over open and owned data, not a primary-source intelligence vendor.
//AUDIT IT
Audit it on your own hardware.
Every claim on this page is designed to be verified in a 14-day POC. How the AI layer stays honest is documented separately, as engineering.