NHN Multi-Node Redundancy Posture
The dominant procurement question in two of the last three NotebookLM critique transcripts. The honest answer is multi-region active-active with sub-second cryptographic failover, RTO and RPO measured in seconds not hours, and a documented walkthrough below covering exactly that 3 a.m. Sunday scenario.
Customer-scoped capacity is provisioned active-active across two geographically isolated NHN-controlled regions. The mTLS tunnel re-pins to the secondary region in under one second on a primary failure, with zero human action. RTO target: 5 seconds. RPO target: 0 seconds for the in-flight session, 60 seconds for the persisted deal-room state. The deal continues. Nobody logs in again.
Every enterprise customer is provisioned with capacity in at least two NHN-controlled regions. The default pair for US-domiciled customers is US-East and US-West; for EU customers, EU-Frankfurt and EU-Amsterdam; for UK customers, UK-London plus a customer-elected secondary. Capacity in each region is hardware-isolated from any other tenant at the silicon, and the two regions are operationally isolated from each other (separate utility power, separate ISP transit, separate co-location provider where feasible).
| Region Pair | Default Customer Type | Isolation Guarantees |
|---|---|---|
| US-East + US-West | US-domiciled funds, US-led deals | Separate utilities, separate ISPs, separate co-location operators |
| EU-Frankfurt + EU-Amsterdam | EU-domiciled funds, EU residency-bound deals | GDPR Article 44-50 compliant local-entity ring-fence at each node |
| UK-London + EU-Frankfurt (customer-elected) | UK Magic Circle, post-Brexit residency | UK-only or UK+EU dual residency depending on intake |
| APAC-Singapore + APAC-Tokyo | APAC-domiciled funds | PDPA / APPI ring-fence (target Q4 2026) |
The numbers procurement committees actually want to see. These are operational targets backed by the architecture, not aspirational marketing.
| Metric | Target | Definition |
|---|---|---|
| Tunnel Re-pin Time | Less than 1 second (typical 200 to 400 ms) | Time from primary-region failure detection to secondary-region tunnel handshake completion |
| RTO (Recovery Time Objective) | 5 seconds | Time from failure to fully operational analytical workflow against secondary region |
| RPO (Recovery Point Objective), in-flight | 0 seconds | Session-state replication is synchronous across the region pair for active deal-room sessions |
| RPO (Recovery Point Objective), persisted | 60 seconds | Deal-room artifact persistence is asynchronously replicated with a 60-second bounded staleness |
| Uptime SLA | 99.95% monthly (production) | Includes failover events; only un-recovered outages count against the SLA |
The cryptographic tunnel re-pin is the load-bearing mechanism. The customer workstation never sees a login screen, the SSO session is preserved, and the analyst keeps typing.
Concrete scenario: it is 03:00 ET on Sunday. The Monday morning signing is scheduled for 09:00 ET. Eight associates and two partners are working in the deal-room ahead of the close. The primary region (US-East) loses power.
The deal does not stop. The associate does not log in again. The partner does not call NHN. The signing happens on time. This is the operational shape of multi-region active-active redundancy on a sovereign-architecture deployment.
This page is the operational redundancy posture. It is not the legal continuity disclosure (see /continuity), the Sovereign Escrow Runbook (see the runbook section on the landing page), or the procurement audit pack (request via diligence@nohumannearby.com). The four layers (availability, continuity, runbook, legal) compose; they do not substitute for each other.
For the customer-specific region pair selection, the network-architecture deep-dive, the SLA credit schedule, or the cross-region observability spec:
Email: diligence@nohumannearby.com