Skip to content
Art2link ESB HomeDocumentationBlogContact
Updated May 5, 2026
Security & compliance/Security overview

Security overview

Art2link ESB does not ask you to send your data to a vendor’s cloud. The product deploys into your Azure subscription, your VNet, your region, and that one architectural decision does more for your security posture than any feature list. This article is the map: where the platform runs, who secures what, and what actually listens on the network.

Deployment model
Your tenant, your data

An Art2link ESB deployment is provisioned from the Microsoft Marketplace into a subscription you own, inside a VNet whose address range you choose at deployment time. Everything stateful the platform touches, message bodies, the TrackingDB, log streams, snapshots, and Authentications, lives on Azure resources in that subscription. There is no Cerebrum City-operated service in the data path, no message ever transits a vendor cloud, and data residency is whatever region you deployed into.

Your Azure tenant your subscription · your VNet · your region Portal (UI) public HTTPS API Listener public HTTPS Runtime web apps private traffic only The bus message exchange SQL config · tracking Blob storage snapshots · logs Everything stateful stays here message bodies · TrackingDB · logs · snapshots · Authentications Operators Partner systems TLS 1.2 TLS 1.2 Cerebrum City DevOps no standing access updates, contract-gated, customer-approved
Why this matters to a security review. Most questions on a vendor questionnaire, where is data stored, who can reach it, which region, who holds the keys to the infrastructure, collapse into one answer: it is your subscription, governed by the same Azure policies, locks, and access reviews as everything else you run.
Shared responsibility
Who secures what

Because the platform runs on Azure services inside your tenant, security responsibility splits the same way it does for anything else you host on Azure, with Art2link adding the application layer on top.

PartyResponsible for
MicrosoftPhysical datacenters, hypervisor, and the security of the managed Azure services the platform runs on, App Service, SQL, Service Bus, Storage, backed by Microsoft’s compliance certifications.
YouThe subscription and everything you govern in it: Entra ID sign-in policies (MFA, conditional access), network rules, Azure RBAC on the resources, subscription-level locks and policies, and who in your organization gets an Art2link role.
Art2linkThe application layer: encrypted credential storage, role-based access inside the portal, the audit stream, and secure defaults at deployment.
Network surface
What listens on the network

The exposed surface is deliberately small. Two things accept connections from outside the VNet:

EndpointExposureProtected by
Portal (UI)Public HTTPS, TLS 1.2, CORS-restrictedSign-in, Entra ID on Grow and Enterprise, application account on Starter.
API Listener ingressPublic HTTPS, TLS 1.2Bearer token plus header combination, unique per running listener system-wide.

Everything else stays private: traffic between the platform’s own web apps does not leave the private network, and the data services, SQL, Service Bus, Storage, are not part of the public surface. Outbound, each adapter negotiates its own transport security with the endpoint it calls; the per-protocol picture is in Data protection.

Read next
The rest of the security story

Identity & access covers who can sign in and what each role can touch. Data protection covers encryption in transit and at rest, secrets handling, and retention. Compliance covers inherited Azure controls, audit evidence, and how Cerebrum City itself operates. The audit machinery referenced throughout, the hash-chained operator audit stream, retention windows, and framework mappings, is documented in Logs.