What we protect, from whom, with what.
The analysis on this page is written by hand. The control states are not: they render from the same capability source Security and Proof render, so this page cannot drift from them again. Controls are separated into what runs with a production assertion, what is proven in a named test only, what is a written commitment with no mechanism behind it, and what is simply not built. A control with no assertion covering it says so rather than borrowing the result of an unrelated gate.
Assets
Trust boundaries
user machine → thin client → KeepState control plane → microVM guest → metering gateway → model provider
Controls
implemented control
2A mechanism that runs, with an assertion against the standing production daemons.
Gateway-managed provider credentials stay outside the guest. Secrets written into guest memory or workspace can be captured by a checkpoint.
Evidence register dated 2026-10-23; recorded deployment: enabled in production. Current deployment not independently verified.
Historical production checks report per-account checkpoint encryption and account deletion that made the tested saved content unreadable. Continued protection depends on key custody; this is not evidence of per-session deletion.
Evidence register dated 2026-10-23; recorded deployment: enabled in production. Current deployment not independently verified.
Read this section
tested assertion
5A mechanism proven in a named test that is not asserted in production.
Hardware virtualization isolates each session guest. Historical lifecycle tests cover the tested runtime and architecture; they do not constitute a penetration test or proof against shared-host attacks.
Evidence register dated 2026-10-23; recorded deployment: enabled in production. Current deployment not independently verified.
Built and running in production: opening a customer's session content needs a typed reason, lasts an hour, lands in the customer's own audit trail and sends a security email, and the admin console's gates (ad-1 to ad-4, under ADR-022) proved it on the bench, sabotage runs included. Outside such a window the content is refused.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Built and running in production: every write a staff member makes through the admin console is logged with who, what and why, and the admin console's gates (ad-1 to ad-4, under ADR-022) proved it on the bench, sabotage runs included. No dedicated public gate covers staff access outside the admin console.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Built and running in production: staff hold roles, and a support role cannot reach owner actions, as the admin console's gates (ad-1 to ad-4, under ADR-022) proved on the bench, sabotage runs included. Mandatory review of production changes is a process with no dedicated public gate.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Historical deletion tests report that deleting the tested account did not damage the other tested account. This limited scenario does not establish isolation against every attack.
Evidence register dated 2026-10-23; recorded deployment: proven, not enabled in production. Current deployment not independently verified.
built control
2A mechanism that runs in production with no dedicated public test.
Built and running in production: every customer route requires a signed-in account and acts only on the sessions that account may reach, by the least role each route names. No dedicated public gate covers authentication or session ownership.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Built and running in production: a restore, wake or fork is accepted only from an account with a role on the session, checked like every other customer route. No dedicated public gate covers it.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
contractual policy
5A commitment in writing. No mechanism is claimed behind it.
A separate hosted self-serve export API is not established by the available evidence. Published data-return and audit rights remain as stated in the legal documents.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
The published 24-hour breach-notification commitment remains as written. Current implementation evidence for the response process is not available; missing evidence does not suspend the commitment.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
The published commitment not to train models on session contents remains as written. Current implementation evidence is not available; provider processing is governed by the applicable provider terms.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
The versioned subprocessor list and its stated notice periods remain binding. The register is an editorial policy record, not a technical test.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Review the workspace before upload: user- or agent-written secrets can enter checkpoints. Documentation of that boundary is not an upload-integrity test.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
future control
3Not built. Named here so its absence is on the record.
Checkpoint secret scanning is not built and is not offered as a guarantee. Keep secrets out of guest memory and workspace.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
The gateway is the supported path for model calls. A general guest egress allowlist is not established; do not treat this as protection against all workspace exfiltration.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
The status page publishes timestamped service checks and incident summaries. Coverage of every service and a staffed response rotation are not established by the available evidence.
Evidence register dated 2026-10-23; recorded deployment: production state unavailable. Current deployment not independently verified.
Abuse cases against the controls
-
A compromised agent image exfiltrates workspace bytes: mitigated today only by the gateway-only egress path (observed, not gated); an egress allowlist is the named missing control.
-
A secret written by the agent lands in every checkpoint: real, disclosed on Security; content scanning is not built or offered as a guarantee, and the advice stands: a workspace is a place secrets do not belong.
-
A stolen checkpoint replays a machine. Checkpoints live on the fleet, each encrypted under its own account key, and the retention and deletion policy states how long they are kept and what deletion destroys. The rows above say which of those controls carry a production assertion and which do not.
-
Abusive form submissions can disrupt intake. Available test evidence covers bounded form validation and durability; it does not establish protection against every abuse pattern.
Read this section
Accepted risks and tested boundaries are recorded in the evidence archive and in Limits. An independent review of this model is a separately gated engagement and is listed as such; when one runs, its findings publish here with dates.