Security, Sovereignty & Zero-Trust.
100% Verified. Zero Black Boxes.
A battle-tested technical compliance framework designed for enterprise clients, banks, and public bodies. Sovereign bare-metal hosting in Casablanca, encrypted real-time telephony (SRTP/TLS), isolated browser sandboxing, and legally binding DPAs under Moroccan Law 09-08 and DGSSI Loi 05-20.
14 / 14 Controls Passed
Casablanca IXP bare-metal peering
Cryptographic DoD multi-pass shredding
Zero password administration
Vext Live Compliance Auditor · Casablanca IXP Console
Simulated live execution against bare-metal test harness (Casablanca IXP)
Morocco's Sovereign Cybersecurity Powerhouse
Beyond PASSI alone. Under Loi n° 05-20, Décret 2-21-406, Décret 2-24-804 (Cybersecurity Providers & SOC), and Décret 2-24-921 (SecCloud Niveau 2), Vext operates the four legally mandated qualifications of the Kingdom of Morocco.
Under Article 49 of Law n° 05-20, it is a criminal and administrative offense for any Moroccan Critical Infrastructure (Infrastructure d'Importance Vitale - IIV), ministry, or regulated bank to outsource security audits, SOC surveillance, or sensitive data hosting to an unqualified provider. Holding state qualification legally obligates public and regulated entities to procure from accredited providers.
Pillar 1: Prestataire d’Audit de la Sécurité des SI (PASSI - 6/6 Domains)
Mandatory statutory security audits for Moroccan Ministries, Public Entities, Banks (Bank Al-Maghrib), Telecoms (ANRT), and Critical Infrastructures (IIV).
Legally mandatory across all 6 technical domains under criminal penalty of Article 49.
Pillar 2: Prestataire de Cybersécurité Opérationnelle (SOC / MDR / CSIRT)
24/7 Managed Detection & Response with 100% telemetry logs hosted in Morocco and automated encrypted incident declarations to maCERT ([email protected]).
Exclusive sovereign surveillance for critical entities interfacing with DGSSI national defense.
Pillar 3: Prestataire d’Homologation & Gouvernance DNSSI (Loi 05-20 Art. 19)
Mandatory security homologation dossier prior to any sensitive information system deployment in Morocco. Automated via our proprietary DNSSI 2023 evaluation engine.
Shields public and banking CISOs from personal criminal liability under Article 49.
Pillar 4: Prestataire Cloud Souverain Qualifié Niveau 2 (SecCloud)
100% Moroccan-owned capital, sovereign datacenter colocation in Morocco, immunity to foreign extraterritorial laws (US CLOUD Act/FISA), and air-gapped cryptographic vaults for "Secret" and "Très Secret" state data.
Legal prerequisite for hosting national vital infrastructure security telemetry and sensitive state databases.
DGSSI PASSI: All 6 Regulated Domains
Full accreditation coverage from IT infrastructure to deep Industrial OT/SCADA systems.
Domain 6: Industrial Systems (OT / ICS / SCADA)
Purdue Model (Levels 0-5), strictly passive network discovery (zero active scanning on live PLCs), unidirectional diodes, SIS/ESD safety.
To audit industrial giants (OCP Group, ONEE, ONCF, Tanger Med, Marsa Maroc, Masen) safely, Vext operates an in-house physical testbed reproducing critical ICS automation networks:
- 100% Moroccan Capital: Held entirely by Moroccan citizens with zero foreign equity or extraterritorial exposure.
- 100% Moroccan Personnel: All auditors and SOC analysts vetted via ADN / DGSN / DGED security clearances.
- Zero Subcontracting Rule: Direct CNSS CDI employees only for sensitive IIV and Niveau 2 workflows.
To comply with DGSSI anti-conflict regulations, Vext strictly isolates VEXT Audit & Homologation (PASSI Unit) from VEXT CyberDefense & SOC (Operational Unit). The team that configures or monitors a client's SOC is legally and physically prohibited from auditing that same client.
The 14 Technical Security Controls
Audited against Moroccan Law 09-08 (CNDP), DGSSI Law 05-20, ISO 27001, and RFC standards.
1. Sovereign Hosting & Data Localization (CNDP & DGSSI Alignment)
All client databases, vector stores, and real-time processing nodes reside on local Moroccan bare-metal colocation or compliant edge regions with zero foreign telemetry egress.
Reference Standard: ISO 27001:2022 Control A.8.14 (Redundancy & Sovereign Colocation)
Moroccan Jurisdiction: Loi CNDP 09-08 (Art. 43/44) & Loi DGSSI 05-20
Direct BGP peering with Moroccan telecommunications transit through the Casablanca Internet Exchange (CAS-IX). Egress firewalls reject all traffic directed towards US-headquartered analytics sinks (Segment, Mixpanel, Datadog US).
In strict compliance with Moroccan Law 09-08 (Articles 43 & 44) governing the transfer of personal data to foreign countries, Vext deploys all production client workloads onto dedicated Moroccan colocation infrastructure located in Casablanca. Real-time audio processing, relational data, and vector embeddings never transit through foreign third-party clouds unless explicitly authorized under an individual CNDP international transfer permit.
✓ Casablanca IXP Peering Active · GeoIP Lat: 33.5731° N, 7.5898° W · 0 Cross-Border Telemetry Packets Detected.
/etc/nftables.d/sovereign-egress.conftable inet sovereign_filter {
set morocco_trusted_subnets {
type ipv4_addr
flags interval
elements = { 105.154.0.0/15, 196.200.160.0/20, 196.217.0.0/16 }
}
chain egress_gate {
type filter hook output priority 0; policy drop;
# Allow established connections & loopback
ct state established,related accept
oif "lo" accept
# Allow local Casablanca private mesh and authorized telemetry nodes
ip daddr @morocco_trusted_subnets accept
# Explicit block: foreign telemetry and unauthorized cross-border egress
ip daddr { 52.0.0.0/8, 54.0.0.0/8 } log prefix "[CNDP-EGRESS-BLOCK] " drop
counter log prefix "[UNAUTHORIZED-EGRESS-DROP] " drop
}
}2. Bare-Metal & Hypervisor Hardening
Strict nftables firewalls, root SSH password logins permanently disabled, Ed25519 cryptographic keys required, and hardware-backed MFA on all internal administration.
3. Tenant Data Isolation (Multi-Tenancy Security)
Strict logical and containerized database segregation ensuring no client AI model context, voice recording, or transcript can ever cross-contaminate another tenant.
4. Automated Vulnerability Scanning & Dependency Auditing
Weekly automated container image scans (Trivy), daily dependency audits (npm/pip), and continuous SAST checks integrated into all deployment pipelines.
5. SIP Trunking & Session Border Controller (SBC) Hardening
SIP endpoints shielded against toll fraud, unauthorized PBX registration, and brute-forcing via strict IP allowlisting, digest challenges, and Kamailio rate limiting.
6. Encrypted Media & Signaling (SRTP / TLS)
Mandatory TLS for all SIP signaling and SRTP (Secure Real-time Transport Protocol) with AES-256-GCM for live voice packets to prevent wiretapping.
7. Ephemeral Audio Processing & Zero-Retention Policy
Voice ingestion pipelines automatically purge raw audio within 24 to 72 hours, retaining only anonymized transcripts or structured operational summaries.
8. LLM Prompt Injection & Guardrail Defenses
Multi-stage input sanitization, system prompt isolation, and strict output guardrails preventing callers from jailbreaking voice agents or invoking backend tools unlawfully.
9. Cryptographic API & Secret Management
All third-party API credentials, database keys, and SIP passwords stored using authenticated AES-256 encryption or HashiCorp Vault, with zero hardcoded repository secrets.
10. Browser Automation Sandboxing
Automated browser agents (Playwright/Puppeteer) run in isolated, ephemeral container sandboxes with strict egress policies preventing SSRF attacks.
11. Webhook Signature Verification
All inbound and outbound webhooks are cryptographically signed using HMAC-SHA256 with timestamp replay-attack prevention.
12. Comprehensive Audit Logging
Immutable, append-only security audit trail recording all administrative actions, configuration changes, API key rotations, and data access events.
13. Data Processing Agreement (DPA / Sous-Traitance)
Formal, legally binding DPAs defining Vext as a technical processor with precise data handling boundaries and obligations under Moroccan Law 09-08.
14. Secure Offboarding & Wiping Protocol
Verifiable multi-pass data destruction procedure (`shred` / secure database drop) to wipe all client artifacts, audio logs, and backups upon contract termination with a signed certificate.
Official Enterprise Security & Legal Dossiers
Direct technical specifications, DPA agreements, and verifiable RFC 9116 policies.
Enterprise Security Whitepaper
Complete 14-control technical architecture, threat mitigation matrix, and audit commands.
Model Data Processing Agreement (DPA)
Sub-contractor terms conforming to Moroccan Law 09-08, data subject rights, and breach timelines.
Sovereign Infrastructure Hardening Guide
nftables firewall rule sets, Kamailio SBC filtering configs, and gVisor container profiles.
RFC 9116 Security Policy
Vulnerability disclosure program, PGP public key, and canonical security contact.
Dossier d'Homologation DNSSI 2023
Dossier officiel d'homologation de sécurité selon l'Article 19 de la Loi n° 05-20. 14 chapitres DNSSI audités avec avis technique formalisé pour les ministères et IIV.
4 Piliers Souverains & PASSI 6/6
Matrice exhaustive des 4 qualifications DGSSI (PASSI, SOC/MDR maCERT, Homologation, SecCloud Niveau 2) et spécification du banc d'essai OT/SCADA.
Frequently Asked Questions by CISOs & DPOs
Rigorous, transparent answers to institutional security and procurement questions.
Q: Where is client voice audio and database records stored physically?
All client databases, speech recognition models, and conversational artifacts reside exclusively in dedicated bare-metal colocation facilities in Casablanca, Morocco. Direct BGP peering connects to the Casablanca Internet Exchange (CAS-IX). Zero client data leaves Moroccan jurisdiction without explicit prior CNDP authorization.
Q: Are our confidential conversations used to train third-party AI models?
Never. We do not feed customer calls, voice audio, or ERP database records to commercial generative AI providers. Your models run either entirely locally or on isolated enterprise VPC instances with strict zero-data-retention agreements.
Q: How does Vext handle Moroccan Darija speech-to-text securely?
Darija audio packets are streamed over SRTP directly to our Casablanca bare-metal DSP pipeline. Audio chunks are decoded in volatile RAM and immediately discarded after acoustic inference, ensuring that recordings do not linger on unencrypted disks.
Q: What is the data destruction procedure upon contract termination?
We execute a NIST SP 800-88 Rev. 1 compliant decommissioning workflow: tenant schemas are dropped with WAL zeroing, scratch storage is overwritten with 3-pass DoD 5220.22-M zeroing, customer KMS keys are destroyed, and a formal signed Certificate of Destruction is delivered within 14 business days.
Need a Custom Security Review or Institutional Audit?
Our senior systems architects and compliance engineers in Casablanca are ready to walk your CISO and DPO through our live infrastructure.