ENTERPRISES
SMBs
AGGREGATORS
USECASES
TECHNOLOGY
ARCHITECTURE
SECURITY
OUR WORK
ABOUT US
BROKERS
Advisers
Aggregator/Association
Accountants
BOOK A STRATEGY CALL
Security is not a
layer we add on.
It is the layer we are.
Every action governed. Every connection controlled. Every decision auditable. Security inside Chameleon is not a compliance exercise, it is the architectural foundation that makes regulated AI deployment possible.
Designed for the most demanding regulated environments on earth.
Regulated financial services institutions face a security standard that is unlike almost any other industry. Every AI action must be authorisable. Every system interaction must be auditable. Every data access must be governed.
Chameleon is built for that standard, not retrofitted to meet it. Security is not a feature set. It is the execution layer itself.
No implicit trust at any connection point
Every request authenticated, every connection authorised, every action validated, regardless of origin. Internal services are treated with the same scrutiny as external ones.
Access is explicit, minimal, and role-scoped
Every agent, every user, every service receives only the access required for its specific function. Access does not inherit upward. It is granted explicitly and revoked precisely.
Every action leaves a complete record
Audit trails are not generated retrospectively. They are created at the point of execution, before any action takes effect. Every decision, every data access, every AI output is recorded and attributable.
Data protected in transit and at rest
All data encrypted in transit using TLS 1.3. All data at rest encrypted using AES-256. Keys managed through AWS KMS with rotation policies enforced at platform level.
Six layers of security between the outside world and your data.
Security is enforced at every tier, from edge protection before a request reaches any service, to access governance inside the execution layer, to encryption at the storage tier.
Every request verified before it enters
All traffic routed through CloudFront CDN and AWS WAF with DDoS shield protection. No request reaches any application service without passing edge validation.
- AWS WAF custom rule sets
- DDoS Shield Advanced
- CloudFront CDN with geo-restriction
- Route 53 health-check failover
Authentication at every interaction point
Cognito SSO and MFA enforced for all user access. API Gateway validates every inbound request. Service-to-service calls authenticated via IAM roles, never static credentials.
- Cognito SSO with MFA
- API Gateway request validation
- IAM role-based authentication
- Zero static credentials
Private infrastructure by default
All application workloads run inside a private VPC. Public subnets contain only load balancers. Application and data tiers are fully private. No open SSH ports at any tier.
- Amazon VPC private subnets
- Multi-AZ availability zones
- Least-privilege security groups
- No direct internet access to app tier
No exposed keys at any integration point
Chameleon connects to your enterprise systems without exposing credentials to the configuration layer. All keys managed through AWS Secrets Manager and KMS. Business users configure integrations without ever seeing credentials.
- AWS Secrets Manager
- KMS key rotation enforced
- No credentials in configuration layer
- Role-based enterprise isolation
Continuous monitoring across every service
CloudWatch metrics and alerting across all components. CloudTrail captures every API call. X-Ray tracing provides end-to-end request visibility. Anomalous behaviour flagged in real time.
- CloudWatch dashboards and alerts
- CloudTrail API audit
- X-Ray distributed tracing
- Real-time anomaly detection
Engineered for zero-downtime operations
Multi-AZ active-active deployment with automated failover. ECS Fargate auto-scaling. RDS Multi-AZ with automated backup and point-in-time recovery. No single point of failure at any tier.
- Multi-AZ active-active
- Automated failover health checks
- RDS point-in-time recovery
- Zero-downtime deployment pipelines
Security inside Chameleon is not a layer we added when clients asked for it. It is the architecture we built first, because you cannot govern AI safely in regulated finance without it.
Your environment. Your sovereignty. Your choice.
Two deployment options. Same platform. Same security architecture. Same auditability. Different operating model. Whichever you choose, your regulators see the same controls.
Managed SaaS on AWS
Enterprise-grade AWS infrastructure managed entirely by Chameleon. Multi-AZ, auto-scaling, zero operational overhead for your team. Security patches, platform upgrades, and infrastructure management handled without your involvement.
- Multi-AZ across AWS regions
- Zero operational overhead
- Continuous security patching
- SLA-backed uptime
Private Instance on Your AWS
Dedicated Chameleon instance deployed within your own AWS VPC. Your access controls. Your upgrade schedule. Your data never leaves your infrastructure perimeter. Full platform capability with complete internal sovereignty.
- Deployed inside your own AWS VPC
- Your access controls and IAM policies
- Your upgrade approval process
- Data never leaves your perimeter
Security that extends to every AI action your platform takes.
Most security architectures were built before AI agents existed. Chameleon's governance layer was built with autonomous AI action as the core design constraint, because governing AI behaviour at scale requires capabilities that traditional security infrastructure does not have.
Every AI action explicitly authorised
No agent action executes without passing through the authorisation layer. Actions are validated against role permissions, data access policies, and business rules before execution. The agent does not decide what it is allowed to do, the platform does.
Complete decision trace on every output
Every AI output includes a complete trace of the decision logic that produced it: which model, which data, which rules applied. Explainability is generated at the point of execution, not added after the fact.
Agent actions scoped and bounded
Every AI agent operates within explicit capability boundaries. Agents cannot exceed the permissions of the human role that configured them. Lateral movement between system contexts is blocked by design, not by policy enforcement alone.
Regulator-ready audit trail by default
Every AI interaction, prompt, reasoning step, tool call, and output, plus any downstream action, is captured in an immutable audit trail. APRA and ASIC inquiries can be answered from platform-generated records without retrospective reconstruction.
Security is not a tier. It is the platform.
Sydney NSW 2000