SECURITY MODEL
Air-gapped, or connected only to the systems you already secure. The image proves itself while it runs.
THE IMAGE
Software that proves itself, continuously.
SIGNED IMAGE
The software image is sealed, signed, and read-only; nothing is altered in place at runtime.
ATTESTED
Each node proves what it is running before it joins a Grid or accepts work.
WATCHMAN
The image and the enclosure's tamper indicators are re-verified while the system runs.
PROVENANCE ON RECORD
Integration, sealing, and software load are recorded for every node.
THE BOUNDARY
Declared routes, a local record, signed change.
LOCAL BRIDGE
No default path out.
The site's own systems are reached over declared routes only, and every crossing is logged.
THE RECORD
Written for someone who was not in the room.
Every prompt, retrieval, response, tuning run, and update lands in a local, append-only record.
UPDATES AND ROLLBACK
Signed, or not at all.
Bundles arrive by download or by media, are verified before they apply, and can be rolled back to the previous signed release.
RESPONSIBILITIES
A short shared-responsibility model.
Short because the sharing is not complicated.
- ELEMENT 31 OWNS
- The build: the signed image, the update bundles, and the provenance record that ships with every node.
- YOU OWN
- The boundary: physical access, declared routes, the documents, and when a signed update is applied.
- NOBODY GETS
- A remote path in. The platform never phones home; remote sessions are customer-initiated.