PUBLIC TECHNICAL DOCUMENT · TES-BTD-001

Read-Only Architecture Whitepaper

Security architecture of the TES Remote DCIM Platform (module GPUasS AI-Client Engine v.1.0) and its on-site Edge Collector. Intended for client system administrators, information-security officers, auditors and bank compliance teams.

DOCUMENTTES-BTD-001

VERSION1.0

CLASSIFICATIONPublic

OWNERTech-Engineering Solutions LLP

Ask a security question

01Scope and design principle

The platform follows a Hub-and-Spoke topology. Each client facility (spoke) runs one or more Edge Collectors that only read telemetry from local equipment and only push it to the central hub operated from Astana, Kazakhstan (UTC+5). The hub has no technical channel back into the client network.

Core guarantee: the Edge Collector exposes no listening network ports and contains no command handlers. The hub physically cannot send a control command, reboot a server, change GPU clocks or power limits, or otherwise influence client hardware.

02Edge Collector runtime hardening

Control	Implementation
Packaging	Lightweight Docker container, Python 3.12. Footprint: 1 vCPU, 1 GB RAM, 10 GB disk.
User	Unprivileged non-root user (`--user 10001:10001`), all Linux capabilities dropped, `no-new-privileges`.
Filesystem	Read-only root filesystem; the only writable volume is the local spool `/var/lib/tes/spool`.
Network inbound	None. No published ports, no listening sockets, no remote shell, no command handlers.
Network outbound	HTTPS (TLS 1.2+) to `hub.tesmonitoring.com:443` only. Can be pinned by the client firewall to a single FQDN.
Secrets	Per-site HMAC key `/etc/tes/site.key`, mounted read-only, unique for each site.

03Transport, authentication and integrity

Metrics are sampled every 15 s and aggregated to min / avg / max over 60 s (3–6× less traffic), then gzip-compressed.
Each batch is sent via POST /api/v1/ingest/batch and signed with the per-site key using HMAC-SHA256.
Replay protection: the hub rejects requests whose X-TES-Timestamp deviates by more than ±5 minutes.
Strict idempotency: a repeated batch_id is acknowledged but never stored twice.

X-TES-Signature = hex( HMAC-SHA256( site_key, timestamp + "." + body ) )

POST /api/v1/ingest/batch HTTP/1.1
Host: hub.tesmonitoring.com
X-TES-Site: SITE-EU-01
X-TES-Collector: COL-MODULAR-01
X-TES-Timestamp: 2026-10-28T14:30:00Z
X-TES-Signature: 8f9c2b4e7a1d...
Content-Encoding: gzip

04Resilience: 72-hour local spool

If the site uplink fails, the Local Spool (store-and-forward) buffers telemetry on disk for at least 72 hours. When connectivity returns, batches are replayed in order; idempotency on batch_id guarantees that no sample is lost or duplicated.

05Data minimisation and edge pseudonymization

Only machine telemetry is collected (temperatures, power, utilisation, clocks, fan speeds, ECC counters, throttle flags, climate and cooling values). No user data, workloads, files or network payloads are accessed.
With privacy.pseudonymize: true, host names (host_alias) and hardware serial numbers are replaced by cryptographic hashes before data leaves the site.
The mapping table between real identifiers and hashes stays exclusively inside the client's data-center perimeter.

06Hub-side tenant isolation

Data is organised in the hierarchy Tenant → Site → Room → Rack → Device → Metric. Each tenant's telemetry, ML models, reports and RAG knowledge base (local LLM, no external clouds) are logically isolated. Reports are exported as PDF / CSV / JSON with SHA-256 checksums for audit trails.

07Supported read-only sources

Adapter	Equipment
nvidia-smi	NVIDIA GPU accelerators (query mode only)
DCGM Exporter	NVIDIA DCGM Prometheus endpoint (HTTP GET, local)
IPMI / Redfish	Server BMC sensors (read-only account recommended)
SNMP / Modbus	PDU, UPS, CRAC/CRAH, dry coolers (SNMP GET / Modbus read functions)
CSV import	Historical data and third-party systems

08What the hub can NOT do

Open a connection into the client network.
Execute commands, scripts or updates on the Edge Collector host.
Write to IPMI/Redfish, SNMP SET or Modbus write registers.
Change GPU clocks, power limits, fan curves or reboot any device.
De-pseudonymize host names or serial numbers.

Collector updates are performed only by the client's administrator by pulling a new signed image version (check & run).

09Document control and contact

Tech-Engineering Solutions LLP (ТОО «Техно-инжиниринговые решения»), BIN 221240000460
Z00Y7B8, Astana, Nura district, Turan Ave., building 46/1, office 613, Republic of Kazakhstan
Web: tesmonitoring.com · Email: info@tesmonitoring.com · Phone: +7 911 283 53 20