All capabilities Proof it stays yours · private

Nothing leaves your perimeter.

Self-hosted on your machines, against your models, inside your network. The model, the work, and the trail stay within your walls — by construction, not by policy.

Where everything lives

The agent, the model it calls, your data, and the audit trail all run on your infrastructure. There is no outbound path for any of it.

By construction. Privacy isn’t a setting that could be misconfigured — there is simply nowhere for the data to go.

Why there is no egress path
Causal recordcau·c9d0e1f2
produced_byperimeter.guard
egress_paths0
modellocal · your weights
datanever copied out
contained — inside your walls

Invariant The model, the work, and the trail never leave your network. There is no egress path to misconfigure.

Go deeper — the perimeter

How the four surfaces stay inside your network, and why there is no egress path to disable in the first place.

Read the doctrine