Security
What your CISO and your auditor can check.
Plain facts: what is built and measured today, what is not built yet, and how anyone can check the proof without trusting us.
Your review
The questions your security review will ask.
Here are our answers, and what each one rests on. Where the answer is not yet, we say so.
| The question | The answer | Based on |
|---|---|---|
| Where can an agent send our data? | Only to the places on its approved list. Anything else is turned back at the one door and written down, with the reason. | Door test: a place not on the list was refused |
| What if the machine crashes halfway through a task? | Each action is written down before it happens. On restart, the done steps are skipped and the rest finish. Nothing is done twice. | 5 forced-crash tests: 0 duplicates, 0 lost |
| Can you prove which version was running? | The machine checks itself every time it starts, and a changed system does not start. It signs what it started with. | Start-up check on every boot |
| Can we check the proof ourselves? | Yes. A separate checker, away from the machine, checks the signature and the record. | Checker and test report |
| Does our data leave our network? | It runs on your own servers or cloud account and reaches only the places you approve. | Runs where you put it |
| Can the host operator see our data? | Not yet — on our roadmap. Whoever controls the host can see the machine's memory today. | Planned, not built |
| Is it certified? | There are no certifications yet. It gives you evidence for your audit. It does not replace the audit. | No certificate claimed |
The facts
Built and measured today, and not built yet.
Both lists matter. A security review should hear the second one first.
Built and measured today
- A sealed system. One read-only image that checks itself on every start. A changed system does not start.
- One guarded door for every outbound call, closed by default. Each decision is written down with its reason.
- A logbook kept before each action, so a restart does not repeat one.
- A signed receipt of what started and where the machine connected, checked away from the machine. Signing every action arrives with the current release.
- A locked sandbox for tool code that you do not fully trust.
- About 3.5 s from power-on to ready, on 2013 hardware.
Not built, or not claimed
- Signing keys. Version 0.1.0 uses development signing keys. Keeping production keys safe is planned for v0.2.
- Hiding data from the host operator. Not yet — on our roadmap. Confidential VMs are planned and not built.
- Certification. There are no certifications yet.
- Identical rebuilds. Rebuilding the same image from the release tag is still in progress.
- Tenants on one machine. We make no claim that agents of different tenants are walled off inside one machine. Use one VM per tenant.
Every number on this site comes from a test you can rerun. See the benchmarks · Read the test report
Measured 2026-10-14 on the image built from tag phase-7, median of 3 runs where run three times, 2013 Intel i7-4770 under KVM.
Check it yourself
How anyone can check the proof.
You do not need to trust us. The check runs on your own computer, away from the machine.
- Ask the machine for a signed receipt. Send a fresh random number with the request, so an old receipt cannot be passed off as new.
- Run the separate checker on your own computer. It shares no code with the machine it is checking.
- Read the result. The checker confirms the signature, what the machine started with and the places it connected to.
- Try to cheat it. Change any line of the receipt and the check fails.
Send us your security questionnaire.
We will answer every question in writing, including the ones where the answer is not yet.