Subscribe to GEN
Login to GEN
Our two subterranean data centres are run as closed secure environments. They hold our own data and that of our customers, and they house our HelpDesk teams. Everything in it is built on a single principle: the default answer to "can data leave here?" is no, and every exception is deliberate, documented and technically enforced.
What follows is a description of how our own facilities actually operate, not a specification we sell to others. The general model is set out in What is a Secure Environment.
The most important security decision we have taken is about what we refuse to put inside. Everything else is somewhere else. GENSoftware development, Administration, Finance, Sales, Marketing, Web design and Social all operate from separate sites, on separate infrastructure, with no route into the secure environment.
This is not an accident of history, it is the design. Those functions need the things a secure environment cannot tolerate: the open Internet, external email, telephones, social platforms, supplier portals, marketing tools, video calls with prospects, and software downloaded from the wider world. Housing them alongside the data would mean punching a hole through every control on this page, and the hole would then exist for everybody. Sales do not need access to customer data to sell, Finance does not need it to raise an invoice, and Marketing certainly does not need it. So they do not have it, and they are not in the building.
The consequence is a very small population inside the secure zone, doing a narrow set of things, with no business reason for a general connection to the outside world. That is what makes the rest of the controls affordable and enforceable rather than aspirational.
Both data centres are below ground, which removes the entire category of attacks that begin with a window, a wall or a vehicle.
We do not publish where they are, and address details are given only to those who genuinely require them. Nothing is delivered to a data centre: couriers deliver to our service hubs, and our own staff carry everything onward.
Not escorted, not by appointment, not for tours. Our data centres are not customer facing and nobody outside the operational teams goes in. A control with an exceptions process is an exceptions process.
Screened against EM radiation including solar events, air-burst weapons and NEMP. The same screening substantially frustrates both radio exfiltration and passive emission capture.
100% green grid supply, our own solar, and the ability to run on backup power for extended periods. Availability is a security property, not merely an operational one.
The two sites take diverse routes from different carriers, so no single physical path carries our traffic and no single cut isolates a site.
The most capable exfiltration device ever built is the modern smartphone: camera, microphone, encrypted storage, an independent radio path out, and a screen its owner is entitled to look at. No amount of network engineering compensates for allowing one inside.
Every member of staff is issued a hardware security token, and it is mandatory. Nothing can be logged into without one. There is no password only route, no fallback and no emergency bypass, because a bypass that exists is a bypass that will eventually be used.
The credential and the person are only ever brought together inside the facility, under supervision. A token held on site cannot be stolen from a bag on a train, used from a home network, or quietly borrowed at the weekend.
There is no remote access to our secure environment or to customer systems, for anyone. Not for engineers working from home, not for managers, and not for the partners who own the business. Customer systems can be reached only by our HelpDesk and Operations teams, from inside the data centre, through every control on this page.
That is deliberate, and it closes the one route no technical control can: coercion. Someone who threatens, blackmails or kidnaps a member of our staff, a director or a partner gains nothing, because nobody has access they could hand over from outside: the only way to a customer system is in person, inside the data centre, through every control on this page. Outside the data centres, even our own staff reach only our business systems over the mesh, through a gate and in one direction, and never a customer system.
So every connection to a customer system starts from a known endpoint inside the data centre, opened with a named person's own hardware key, and every one is logged. We cannot make our clients' own systems secure for them, but our side of the connection is fully accountable, and we can show exactly who reached what, and when.
Every system in our secure estate runs Linux: servers, workstations, firewalls, hypervisors, storage, telephony, GPU nodes and appliances. There is no Microsoft software anywhere in it. No Windows, no Active Directory, no Exchange, no Microsoft 365, no Teams, no OneDrive, no Entra.
That is not a verdict on the many businesses that run Microsoft well, and we support a good number of them. It is a judgement about what a closed environment needs. Windows carries a long record of critical vulnerabilities and a monthly patch cycle that has never stopped, and a platform that needs patching that often has that much surface to defend. Where every route out has to be accounted for, we would rather run fewer, simpler things that we can inspect for ourselves.
Then there is single sign-on, sold as convenience and, to an attacker, a single point of catastrophic failure. One identity unlocks the mail, the files, the finance system, the customer records and the administrative console, so when that identity is taken, and it is a prime target, the attacker inherits the entire company in one step. Companies have lost their livelihoods to exactly this, with the architecture working as designed while it happened. We do the opposite: identity is compartmented, access is granted per system, and no single credential opens everything.
Linux gives us what the environment requires: source that can be inspected, builds we control, machines that do nothing we have not asked for, no dependence on a vendor's cloud for identity or licensing, and stability without forced change. Systems are deployed from hardened standard images, users hold no local administrative rights, and machines are rebuilt rather than repaired.
There is not a single hard disk in a workstation anywhere in the secure environment. Every machine on the operational floor network boots from a central server and runs entirely in RAM. There is no local storage to write to, no persistent profile, and nowhere for anything to be kept.
Switch a workstation off and back on and it returns to the standard image, exactly as it was built. That is not a limitation we tolerate, it is the point of the design. Nothing accumulates on a desk machine, nothing survives on one, and nothing can be quietly stored on one. Malware that reaches a workstation has a lifespan measured by the next reboot, a machine cannot drift away from its build over time, and a workstation removed from the building is an empty box. It also means recovery from any doubt about a machine is a power cycle rather than an investigation.
Nobody installs software. There is no application store, no download and no "just this once". The environment carries a deliberately small catalogue, each application assessed, packaged, version-pinned and allow-listed by name and cryptographic signature. Anything not on the list will not execute, including anything a user manages to write into their own home directory.
Every candidate is assessed for what it can reach: whether it phones home, whether it syncs, whether it has a cloud tier, whether it embeds a browser, whether it can open a socket to a destination of its own choosing. Updates are staged, tested and deployed from internal repositories, so no machine ever reaches out to a vendor for a package.
Support is the obvious tension in a closed environment: the engineers who run the data centres sit inside it, and those same engineers answer our customers all day. The answer is that they communicate through the boundary rather than across it, on channels we operate ourselves.
The transport itself is described in GENuinely Secure Communications.
Customer data stays on our own infrastructure. It is not replicated to a public cloud, not backed up to a third party service, and not processed by anybody else's platform on its way to anywhere. Backups are taken within the environment, encrypted, and replicated offsite to our other data centre over the mesh, so a site level loss is survivable without a single byte ever being handed to an outside party. Recovery never depends on anybody else holding either the data or the keys.
Our AI runs on our own GPU hardware, in closed halls of our own, inside the same security domain as everything else on this page: the same private mesh, the same keys, and the same control over who and what can reach it.
That is a deliberate and expensive choice. The convenient alternative is to call somebody else's model over the Internet, which means the prompt, the context and whatever customer material went into it all leave our control and land on infrastructure we do not own, under terms that can change. We do not do that. Models are hosted, run and updated on our own hardware, inference happens inside our security domain, and the data used to support it never touches anybody else's platform. An AI service is only as private as the network path underneath it, and ours is our own.
Controls that are not observed are assumptions. Everything of consequence is logged inside the environment, correlated, and reviewed by people who know what normal looks like here.
Because our customers demand it. That is the honest answer, and it is not a marketing position we adopted and then went looking for buyers of. Not everybody hosting with us is running a virtualised web server for an online retail business, where the worst case is an afternoon of downtime. A great many are doing something else entirely: holding a data lake of material they could never place in a public cloud, running AI compute over information that must never leave their control, let alone reach somebody else's platform, or operating genuinely private cloud and hybrid cloud services where the whole point of the arrangement is that nobody else is in the path.
Those customers ask hard questions before they sign, and they ask them again afterwards. Who can walk into the room where this runs. What can that person carry out with them. Where does the backup go. Whose model processes it. Which third party has a route in, and who audits that. An organisation that has to answer "we are not sure" to any of those has already failed the assessment. We built the environment so that we can answer all of them, specifically, and evidence the answer.
None of it is convenient. It is slower to work in, it constrains how our own people communicate, and it removes tools they are used to at home. We say so plainly rather than pretend otherwise. What it buys is a position we can actually defend: we can state, and demonstrate, exactly what routes exist for a piece of customer information to leave our environment, and account for every one of them. Very few organisations that hold your data can say the same.
Not every business needs all of this, and we would say so rather than sell it. But the principles apply to everybody: know what you hold, know every route by which it could leave, close the ones you do not need, and watch the ones you do. What does not work is the half-way house. You are either security aware or you are not, because security is decided by the weakest route left open, not the strongest one you have closed. Controls applied only when convenient are not controls, they are preferences, and an attacker only has to find the day they were inconvenient.