Skip to content
UMVANGAZI HOLDINGS
Security Start a conversation

Security architecture

Trust should be inspectable.

Security is not a badge added after the interface is finished. The public application, executable demonstrations and restricted laboratories are presented as one experience while remaining different trust zones.

3declared
trust zones 6inspectable
control surfaces D0 – D4risk based
evidence classes

Different trust zones.
One coherent experience.

Trust architecture

Public design baseline

The security architecture separates environments by design while keeping the experience consistent.

Boundaries declared 01 / 03

Describe and connect

Corporate application

Present the group, its capabilities and approved evidence without executing experimental workloads inside the corporate application.

Execution
Corporate web application
Access
Anonymous public access
Data
Public content and controlled enquiry input
Boundary statementExperimental demo code remains outside this runtime.
Browser postureRestrictive response policy Related evidenceInspect evidence catalogue

Control surfaces

A security claim should expose where the control lives.

Each control below is an inspectable relationship. Open the control to see the evidence surface, execution model or client path it protects.

View all controls
01 Public runtime boundary Content isolation Corporate presentation code and experimental execution are kept in different trust boundaries. 02 Response header baseline Browser policy The deployment baseline defines restrictive content, framing, referrer and browser permission policies. 03 Controlled rendering path Input boundary Client controlled values are validated and are not inserted into trusted page templates as executable markup. 04 No default message bridge Demo communication The default demo contract does not expose an unrestricted parent messaging channel. 05 Restricted permission baseline Minimal permissions Demo execution starts from a deliberately small browser permission surface and expands only after review. 06 Separate operational boundary Operational separation Production demo services are expected to keep deployment, secrets, storage, resource limits and logging separate from the corporate site.

Engineering evidence

Controls belong in the product, not only in a proposal.

The public experience is designed so browser policy, input handling, demo isolation and operational separation can be traced to the surfaces they protect.

Inspect demonstrations

Responsible reporting

A security concern has a defined path.

Do not include passwords, private keys, personal information or destructive proof in an initial report. The public reporting path is deliberately separate from demo execution.

Standard disclosure locationView security.txt Client security conversationContact Umvangazi Responsible capabilityExplore Umvangazi Cyber

Umvangazi Cyber

Need the same discipline applied to your systems?

Security architecture, application testing, infrastructure assessment, detection and response are part of the Umvangazi Cyber capability model.

Explore security capabilities