Technical overview

This section describes, at a high-level, which Azure cloud components we use, and which components and technology the solution is built upon.

Cloud components

Which components of the Azure cloud do you use?

Rencore Governance relies on the modern cloud capabilities of Microsoft’s public cloud, Azure.

Virtual networks

• We use multiple dedicated subnets inside a single Virtual Network in each region to maintain subnet level separation, also because Azure requires subnet segregation per resource or resource types.

Managed identity

• We use User Assigned Managed Identity to grant the Functions and Web Apps access to resources like the Azure Key Vault.

Azure Storage accounts

• Stores the system data required for operating the solution.
• Saves the customer data, as is necessary to provide accurate reports.
• The firewall is enabled and only allows traffic through the dedicated subnets. No external traffic is permitted.

PostgreSQL

• Stores the system data required for operating the solution.
• Saves the customer data, as is necessary to provide accurate reports.
• The firewall is enabled and only allows traffic through the dedicated subnets. No external traffic is permitted.

Azure App Services

• Azure Function Apps
• Web Apps

Azure Key Vault

• Secrets and sensitive data are stored here.
• The firewall is enabled and allows traffic through the dedicated subnets. No external traffic is permitted.
• Rencore’s CI/CD platform can deliver updates using short-lived, temporary Just-In-Time network connections.

Azure Container Instances

• Isolated Docker containers, per customer, without externally reachable endpoints or ports.
• Used to retrieve data securely from customer tenants and process in the solution, fully isolated on a per-analysis, per-customer basis. We delete containers after each analysis.
• Resides in the protected virtual network, in the container subnet.

Azure Application Insights

• We send telemetry and diagnostics to an Application Insights instance, enabling us to monitor the solution’s health.

Solution technology

Can you describe the macroscopic solution architecture at a high level?

The solution uses a supported version of .NET (Core not Framework) with a delay of a couple of months after a new major version is released by Microsoft.

The Rencore Governance design looks like this, at a high level:

• Docker containers: Built on the supported version of .NET base images from Microsoft.
• Web Application: Built on the supported version of Blazor, for ASP.NET.
• Function Apps: Built on the latest supported version of .NET.
• PostgreSQL and Storage Accounts: To contain data to run the product.

How do you handle data security in the solution?

We make use of the built-in security mechanisms of Microsoft and their industry-standard data protection layers in-transit and at rest; we regularly verify the security of Microsoft Azure by reviewing Microsoft’s relevant certifications and accreditations.

• At REST: We use all the built-in encryption mechanisms of Microsoft Azure.
• In TRANSIT: We use TLS 1.3 for all communication.