Secure Enterprise Authentication & Role-Based Access Control
Self-Registration Invite Workflow:
Users register their email and create a password via a SWAES invite link. SWAES Super-Admins then assign them to single-site, multi-site, or trust-wide access groups in the backend.
LILLY ALCOBENDAS — WATER MONITORING HUB
Lilly — Madrid Facility
j.smith@lilly.com|Multi-Site (Lilly Global)
Active Site Location:SWAES Logger Stream: 1-Min Sample / 15-Min Uplink | Latest Batch: 06:30:00 (3m ago)
Air-Gapped Cellular
Zero LAN / SCADA Attack Vector
Zero PII / Patient / Student Data
Pre-Cleared Statutory & Sector Security Standards
NHS Foundation TrustsDSPT / Caldicott
Fully decoupled from N3/HSCN and clinical networks. Compliant with NHS Data Security and Protection Toolkit (DSPT) standards. Zero transmission of patient-identifiable data.
MAT Trusts & UniversitiesDfE / Janet Compliant
Meets DfE Cyber Security Standards for schools and Janet network firewalls. Operates without campus Wi-Fi credentials; zero access to staff or student records.
Global Pharma & ManufacturingGxP / ISO 27001
Strict air-gap from OT/SCADA production PLCs. Data immutable at ingest with dual UTC timestamps and cryptographic audit trails for GxP / ISO 50001 compliance.
Statutory Cyber BaselineCyber Essentials+
Aligned with NCSC Cyber Essentials Plus guidelines, UK GDPR, and Data Protection Act 2018. Continuous vulnerability tracking with AWS SOC 2 Type II hosting.
1. Absolute Network Isolation
No Ethernet, Wi-Fi, or LAN Crossover
Hardware loggers transmit via dedicated 4G/LTE CAT-M1 cellular uplinks directly to AWS. Loggers do not touch corporate subnets, eliminating bridging risk into internal databases or medical systems.
2. Zero Inbound Attack Vector
Outbound-Only Telemetry Pipe
Loggers operate with all inbound listening ports closed and disabled. Field hardware cannot receive external commands, unsolicited packets, or internet ping probes, neutralizing remote takeover vectors.
3. Cryptographic Enclave
TLS 1.3 & AES-256 Cloud Vault
Data in flight is encrypted using TLS 1.3 cryptographic transport over private APNs. Cloud storage at rest is governed by AWS Key Management Service (KMS) with AES-256 automated key rotation.
4. Edge Buffering & Custody
Non-Volatile Local Memory
During temporary cellular outages, readings queue in on-chip non-volatile flash. Telemetry back-fills chronologically upon connection restore with SHA-256 verification, preventing audit gaps.
Data Custody & Telemetry Pipeline
Stage 1: Physical Acquisition
Non-Intrusive Pulse / Modbus
Passive read-only magnetic pulse or digital sensor leads. Hardware has zero actuation or valve-control capabilities and cannot interfere with water supply or pressure.
Stage 2: Transmission
Dedicated Cellular Pipe
Direct cellular uplinks over private APN. Completely decoupled from local Wi-Fi, Ethernet, and hospital/campus/plant IP networks.
Stage 3: Cloud Ingestion
AWS ISO 27001 Enclave
Telemetry arrives at AWS EU secure microservices with automated audit logging, access controls, and multi-region backup replication.
Stage 4: Client Portal Presentation
HTTPS / TLS 1.3 Web App
Client interface protected by authenticated sessions and 3-Tier Role-Based Access Control (RBAC).
Role-Based Access Control (RBAC) Governance Matrix
Enforced separation of duties across all client types
Access Tier
Example Target Roles
Data Visibility
Export Rights
System Configuration
Tier 1: Read-Only
Site Caretakers, Shift Technicians, Facilities Staff
Full telemetry streams & raw logger payload archives
Unrestricted raw archive export
Full (Topology, Nodes, Devices)
Institutional Information Governance (IG) Statement:
SWAES telemetry capture is strictly confined to volumetric and hydraulic meter readings. The system does not ingest, transmit, process, or store Personally Identifiable Information (PII), patient data, student records, or corporate financial systems data. All monitoring hardware is read-only and non-intrusive, possessing zero physical or software pathways to modify water supply, pressure, or building operations.
Technical Custodian: Sustainable Water & Energy Solutions Ltd (SWAES)Security Inquiries: engineering@swaes.co.ukArchitecture Version: Enterprise Spec v3.2
