Home / Security & sovereignty
Security & Sovereignty

Sovereignty as an architectural property.

"Your data stays inside your perimeter" is usually a contract clause. Here it's a system property: the design constraint the whole product is built to hold, enforced by architecture, and where data does cross a boundary, the crossing is explicit, permitted, and labelled.

What we operate, and what we can never see.

We operate the control plane and are architecturally unable to read the data plane. That separation is what makes "we run the plumbing, we never see your data" literally true, and it contractually binds our subcontractors as well as us.

Control plane · what we operate
  • Declared configuration: apps, model assignments, access rules, budgets, egress posture
  • System health, versions, reconciliation state
  • Metering: token counts, request decisions, capacity signals
  • The audit trail's control-plane fields
Data plane · what we never see
  • Prompts and responses, in any application
  • Your documents and the retrieval corpus
  • Member memory content
  • Model weights and fine-tuned artifacts on your hardware

Telemetry carries control-plane fields only. What leaves your deployment for our operations is health, versions, and metering, never content. The same constraint is written into every subcontractor relationship: vendor access is contractually scoped to the control and operations plane, never to prompts, documents, or weights.

The control plane lives inside your perimeter.

The surface where models are deployed, access is set, egress is enforced, and your audit trail lives runs self-hosted, behind your firewall, inside your trust boundary. Placing it there was one of the first design decisions in the product, and much of the architecture exists to keep it true.

Update custody

Updates start inside the boundary

Platform and model updates are pulled from a mirror inside your perimeter and applied by a control loop we gate. Automated, but initiated inside the boundary. No vendor, including us, pushes changes in from outside.

Custody

The keys stay in the building

The control plane is the source of truth for access control; it holds the secrets, tokens, and certificates, and it owns the audit log. Custody of keys and audit trail is never subcontracted, to anyone.

One less trust decision

Fewer parties inside the boundary

Every additional party with in-perimeter control-plane access is one more entity your CISO must trust and audit. Our operating model is built to keep that list as short as it can be.

One control path

Configuration is the only way in.

There is exactly one way the system changes: versioned, signed configuration, reconciled by a proven GitOps engine.

  • Every change is reviewed before it applies, with its full effect shown as a diff.
  • Drift is detected and reverted. If anything in the running system is tampered with, it is automatically restored to the declared state.
  • The audit trail is the change history. Who changed what, when, from what, to what: answerable for the life of the deployment.
  • The console structurally cannot do more. "Admin actions are confined to configuration writes" is proven by automated tests at the web layer.
Fault-proven

We break it before we claim it.

Every enforcement control (budget refusal, egress blocking, drift reversion, tamper recovery) is validated by injected-fault tests: deliberately broken, shown to fail visibly, and shown to recover cleanly, before we claim it works.

The same honesty runs through the console: numbers carry their provenance, estimates are labelled, and a quantity the system can't measure renders as a labelled absence.

Honesty as a UX principle →

Boundary crossings are explicit, or they don't happen.

Labelled

Every app states its boundary

An application backed by a third-party model says so plainly: "this application's prompts leave your perimeter to this provider, under your key." The console scores each app's sovereignty as configured.

Governed egress

Permitted, logged, whitelisted

Under controlled egress, only explicitly permitted outbound calls exist: user-invoked web search, docs lookups, whitelisted APIs, third-party model traffic under your key. Each one logged.

Content-free audit

Complete, and incapable of surveillance

Identity, application, model, decision, timestamp, and token counts are recorded for every call, and message content is excluded by construction. An audit your compliance officer can sign and your employees can live with.

Your perimetercrossings are explicit, permitted & labelled
Applications & member memory
Prompts, documents, retrieval corpus, member context — stays inside
Data plane · yours
Governed gateway
Identity · budgets · egress policy · content-free audit — every call passes through
Enforcement point
Permitted crossings only
Third-party models under your key · whitelisted lookups · each labelled & logged
Governed egress
Identity

Your IdP, federated. Offboarding, provable.

Identity federates from your provider over OIDC, so access follows the joiner-mover-leaver process you already run. Remove a person once and the console shows every app and model their access no longer reaches: offboarding you can demonstrate to an auditor.

Air gap

The ladder runs all the way to a full air gap.

The isolation ladder goes all the way to a full air gap: no connectivity, for classified and contractually air-gapped environments. Each rung's tradeoffs are stated up front, so you hold exactly the line your mandate requires.

The isolation ladder →

Bring your CISO's hardest questions.

We built this product to survive a hostile security review. If your team wants to go deep on the boundary, the audit, or the enforcement model, that's the conversation we most enjoy.

Start a security conversation