Nobody is pointing a hosted service at their production database.
So bring your own cloud and on-premises deployment are launch requirements rather than later additions. Building hosted-only first would mean rewriting the deployment model at the first serious customer.
- Inference
- Model agnostic, including customer-managed endpoints
- Air gap
- Supported, with self-hosted open-weight models
- Residency
- Configurable per deployment
Three deployment shapes, all supported from the start.
The platform runs inside your account, against your network. Evidence never crosses a boundary you did not draw.
The same services, self-operated, including the microVM sandbox layer that isolates agent execution.
Snapshot ingestion and self-hosted open-weight models. Slower to refresh, structurally identical.
Production data is redacted before it is stored, not after.
Log lines, query values, trace payloads and replay inputs all pass through configurable redaction on the way in. This is a hard gate in the ingestion path rather than a cleanup job that runs later, because a cleanup job that runs later means the data was stored.
It matters most in verification. Characterization tests are built from real captured traffic, which is exactly the traffic a compliance team will ask about, and the answer has to be that it was never written down in the clear.
What a security review will ask about.
Phase one needs no write access at all, which is why it clears review in weeks rather than never.
| Control | How it works |
|---|---|
| Credential scope | Least privilege per connector, with read-only credentials held separately from write credentials. |
| Write access | A distinct capability, granted explicitly, used only for branch creation and pull requests in delivery. |
| Agent isolation | Hardware-isolated microVMs per session. Untrusted legacy code and autonomous agents share this environment, so container boundaries alone are insufficient. |
| Scope enforcement | An agent touching a file outside its task scope raises a violation for human review instead of proceeding. |
| Audit trail | Unbroken from evidence to merged commit: task, envelope, agent run, pull request, review, replay result, merge, approver. |
| Provenance | Every assertion names its source, whether that is a trace, a commit, or a named human. Overrides are recorded as assumptions with the person who made them. |
| Data residency | Configured per deployment. The platform holds no customer repositories and hosts no source control. |
Eight services, deployable as one unit.
The split follows the planes rather than the org chart. Graph storage has to support deep traversal with provenance filtering, and envelope assembly is a hot path that must stay fast enough for interactive use.
Nothing in the ingestion path writes to a customer system. Write capability lives only in delivery, behind a separate credential.
connector-svc ingestion, scheduling, redaction analyzer-svc language plugins, schema, telemetry joins core-svc graph store, assertions, provenance, query API clarify-svc gap detection, question synthesis, routing planner-svc task generation, envelopes, decision propagation exec-svc sandbox orchestration, dispatch, workspaces verify-svc capture, test generation, replay, classification delivery-svc branch and PR lifecycle, review, merge gating