SECURITY MODEL
Nothing leaves. Everything is on the record.
Substrate's security case is architectural, not contractual: egress that is absent by construction, an image that proves itself continuously, and an audit record written for someone who was not in the room.
Default-deny, declared exceptions.
Substrate does not have an egress policy so much as an egress absence. No route to the public internet exists, and connectivity to your own systems exists only where Local Bridge declares it: a specific route, to a specific system, under a written policy, with every use logged. Connectivity is an exception that has to be justified — never a default that has to be tamed.
This is what changes the security review. The question 'where can data go?' has a finite answer that fits on one page: the declared routes, each with an owner and a reason. There is no appendix about a provider's network, because there is no provider network in the loop.
- No default path to the public internet, in either direction
- Local Bridge routes are declared explicitly and governed by policy
- Every crossing of the boundary is logged and reviewable
Software that proves itself, continuously.
The software load is signed and mounted read-only: nothing is installed, patched, or altered in place at runtime. Watchman re-verifies the running image against its signatures continuously and monitors the enclosure's tamper indicators, writing every deviation to an append-only record.
Integrity is therefore not an installation-day property that decays — it is re-proven while the system runs. If the image and its signature ever disagree, that fact is on the record before anyone has to notice it manually.
- Signed, read-only software image — no runtime mutation
- Continuous verification by Watchman, not periodic scanning
- Tamper indicators monitored; deviations logged append-only
An audit trail that answers questions.
Every prompt, retrieval, response, tuning run, and update lands in the Evaluation service's local audit record: traceable end to end, durable, and queryable by your own oversight functions. The record never leaves the appliance — auditing the system does not mean exporting its history to someone else's tooling.
When a review board asks why the system said what it said in March, the answer is a query, not an archaeology project: the pinned model version, the retrieved passages, the policy in force, and the operator involved are all in one place.
- End-to-end tracing for every AI operation
- Local, durable, queryable — no export required to audit
- Designed to support your oversight and accreditation processes
Change arrives signed, or not at all.
Releases ship as complete, versioned bundles — platform and model artifacts together — signed by Element 31 as a single unit. The appliance verifies the signature and every artifact hash before applying anything; a failure at any step stops the update outright and leaves the system exactly as it was, with the failure logged.
Where no network is permitted, bundles travel on physical media under your handling procedures. There is no update path that bypasses the signature — not for us, and not for an operator under pressure.
- Complete signed bundles; verify-then-apply, never partial
- Air-gap delivery on physical media, same verification
- Every applied update becomes a permanent audit entry
RESPONSIBILITIES
A short shared-responsibility model.
Most shared-responsibility matrices are long because the sharing is complicated. This one is short because it is not.
- ELEMENT 31 OWNS
- The build: assembling, testing, and signing the platform image and update bundles, and the provenance record that ships with every unit.
- YOU OWN
- The boundary: physical access, network policy, the document corpus, workspace scoping, and when a signed update is applied.
- NOBODY GETS
- A remote path in. There is no telemetry to Element 31, no remote administration channel, and no vendor access to your data, ever.
FOR REVIEWERS
Built to be accredited, not just admired.
Every deployment ships with the artifacts a review actually consumes: the configuration manifest describing exactly what was sealed into the unit, the provenance record for its integration and assembly, and pinned versions for every component and model. The system under review does not move while you review it.
We do not claim certifications the platform has not earned, and we do not describe compliance as a property you can buy. What Substrate provides is a bounded, documented, verifiable system — the raw material of your accreditation process, organized so the process is shorter.