Nobody is pointing a hosted service at their production database.

So bring your own cloud and on-premises deployment are launch requirements rather than later additions. Building hosted-only first would mean rewriting the deployment model at the first serious customer.

Inference
Model agnostic, including customer-managed endpoints
Air gap
Supported, with self-hosted open-weight models
Residency
Configurable per deployment

Three deployment shapes, all supported from the start.

Bring your own cloud

The platform runs inside your account, against your network. Evidence never crosses a boundary you did not draw.

On premises

The same services, self-operated, including the microVM sandbox layer that isolates agent execution.

Air gapped

Snapshot ingestion and self-hosted open-weight models. Slower to refresh, structurally identical.

Redaction at the boundary

Production data is redacted before it is stored, not after.

Log lines, query values, trace payloads and replay inputs all pass through configurable redaction on the way in. This is a hard gate in the ingestion path rather than a cleanup job that runs later, because a cleanup job that runs later means the data was stored.

It matters most in verification. Characterization tests are built from real captured traffic, which is exactly the traffic a compliance team will ask about, and the answer has to be that it was never written down in the clear.

Heavy steel vault door with a sealed mechanism

What a security review will ask about.

Phase one needs no write access at all, which is why it clears review in weeks rather than never.

ControlHow it works
Credential scopeLeast privilege per connector, with read-only credentials held separately from write credentials.
Write accessA distinct capability, granted explicitly, used only for branch creation and pull requests in delivery.
Agent isolationHardware-isolated microVMs per session. Untrusted legacy code and autonomous agents share this environment, so container boundaries alone are insufficient.
Scope enforcementAn agent touching a file outside its task scope raises a violation for human review instead of proceeding.
Audit trailUnbroken from evidence to merged commit: task, envelope, agent run, pull request, review, replay result, merge, approver.
ProvenanceEvery assertion names its source, whether that is a trace, a commit, or a named human. Overrides are recorded as assumptions with the person who made them.
Data residencyConfigured per deployment. The platform holds no customer repositories and hosts no source control.

Eight services, deployable as one unit.

The split follows the planes rather than the org chart. Graph storage has to support deep traversal with provenance filtering, and envelope assembly is a hot path that must stay fast enough for interactive use.

Nothing in the ingestion path writes to a customer system. Write capability lives only in delivery, behind a separate credential.

Service topology
connector-svc   ingestion, scheduling, redaction
analyzer-svc    language plugins, schema, telemetry joins
core-svc        graph store, assertions, provenance, query API
clarify-svc     gap detection, question synthesis, routing
planner-svc     task generation, envelopes, decision propagation
exec-svc        sandbox orchestration, dispatch, workspaces
verify-svc      capture, test generation, replay, classification
delivery-svc    branch and PR lifecycle, review, merge gating

Nothing in the prototype touches a real system.

It runs entirely in your browser over seeded data, which makes it safe to hand to a security team before any credential exists.