SafeCore

Multi-environment sovereign virtualisation solution certified by French cybersecurity agency ANSSI

Cyber sovereignty
Cyber protection
Connectivity

SafeCore is an ETSI/NFVi virtualisation infrastructure designed to host network and security functions on Windows and Linux operating systems.

Why choose SafeCore ?

SafeCore is the only virtualisation solution with security-certified partitioning capabilities.

Certified partitioning

Traditionally, dedicated hardware components were needed to isolate network and security functions from each other. SafeCore uses software to guarantee the same level of separation.

SafeCore's virtualisation relies on strict partitioning so that several security domains can be hosted on the same hardware. With SafeCore, VMs, network flows, data are all isolated from each other and from the hardware platform itself. As a result, attacks do not propagate from one VM to another or to SafeCore.
Unified environment on single use device

Having a single device to access multiple security environments overcomes the pain and cost to have one dedicated laptop or desktop for each environment.
With SafeCore’s certified strict partitioning, multiple work environment can coexist simultaneously on the same hardware. Today, those environments can be from different classification domains or levels, according to the regulatory security obligations.
A user accesses several environments as simply and transparently as any virtual desktop, even if each is running a different operating system. Data in each environment is kept strictly separate.
Multiple use cases

The virtualised network node runs everal network and security functions (router, encryptor, firewall, 5G modem) simultaneously.
The Gateway use case ensures isolation between internal and external networks, just like a DMZ.
SafeCore’s strict partitioning enable single-machine hosting of applications from separated security domains.
All use cases - network node, gateway, hosting - can be combined on the same machine, according to hardware performances.

Certified platform designed for multi-environment operations

SafeCore draws on 10 years of experience in virtualisation security. The solution is already in service in critical and sensitive systems for civil as well as military operations.

Compliance with French CSPN security standard (first level security certification) has been assured for each new version of the SafeCore solution. From the end of 2026, the cyber security assurance will be raised and officially endorsed by the world standard CC-EAL4+ (Common Criteria Evaluation Assurance Level).

The objective today is to obtain a Qualification Standard (QS) from the French cybersecurity agency ANSSI, with official recognition for France Restricted, NATO Restricted and EU Restricted security levels.

With SafeCore, full convergence of the latest security technologies brings the benefits of virtualisation to all types of sensitive and critical systems.

Designed to use any generic computer, the solution significantly simplifies the logistics and provisioning chain.

Main features

SafeCore is designed to guarantee the sovereignty and independence of critical systems. Its source code is controlled and auditable, and the solution is fully independent of foreign regulations. Integrity and obfuscation are guaranteed by storage encryption, secure signing software and hosted VMs. A verification is done at boot time.

SafeCore is compatible with all x86 hardware and peripherals supported by Linux. Any VM in KVM/QCOW2 format can be deployed on SafeCore.

Soon, the compatibility wit be extended to ARM architecture.

This broad compatibility and secure virtualisation capability extends the service life of both software and hardware components. Older software can be hosted on more recent servers without interrupting operations or compromising security.

The user experience on the unified device is just as intuitive as on a computer without SafeCore. Performance level is on par with only typical 3% unoticable degradation in multi-environment use.

The technical architecture is designed for robustness. In case of crash, SafeCore ensures a reliable reboot of the system. If need during the a military mission, emergency data wipe can be programmed to deny access to sensitive information

SafeCore is designed to be integrated with the existing infrastructure, including identity management functions. The SafeCard additional product manages secured smartcard shared across the different environments. The additional SafeConnect product guarantees a controlled and secured connectivity with protected networks. Depending on the configuration and access rights, hardware can be managed locally or remotely, and can be integrated securely with supervision systems via SafeConnect.