Services, available now

The tool is public. Reproduce the result yourself.

No-Egress Supply-Chain Audit

You tell customers, regulators, or your own security team that your software runs on-prem with no telemetry. That claim is only as strong as your ability to prove it. We audit your codebase for network-capable imports, git remote operations, shell execution, dynamic code execution, and external references in shipped markup, then sign the result. Anyone can re-run the open-source auditor to check the findings, and the signature shows who issued the report.

• · Signed, tamper-evident report you can hand to a customer or regulator
• · Findings classified by whether they touch shipped code, tests, or docs
• · The same auditor wired into your CI, so every future build is checked again

Scope, written into every report: the network libraries, commands and calls on the auditor's list, in the files it can read. A third-party library that is not on the list produces no finding and is named in the report as unlisted. A clean result means nothing came to our attention in what was read; no static analyzer can prove there is no egress.

Post-quantum migration

Post-Quantum Cryptography Migration

NIST has proposed retiring RSA, ECDH and ECDSA (NIST IR 8547, in draft), and FIPS 140-2 validations moved to NIST's Historical List on 22 September 2026. We inventory your cryptographic surface, design your ML-KEM (FIPS 203) + ML-DSA (FIPS 204) path, and build cryptographic agility in, so your next algorithm transition is a configuration change, not a redesign.

• · Cryptographic inventory & risk map
• · Migration architecture (ML-KEM + ML-DSA)
• · Agility layer: swap algorithms without protocol redesign

What you get: inventory, architecture and migration design for your systems. Our ML-DSA-65 signing uses Cryspen's libcrux, whose verifier passes 210 of 210 Wycheproof ML-DSA-65 verify cases in our own tests; the test run is shown on request. Our audit reports carry the auditor's own hash-based signature (Lamport-Merkle over SHA3-256), which claims no published standard.

EU AI Act: energy documentation for general-purpose AI

AI Energy Disclosure & Attestation

The EU AI Act requires general-purpose AI model providers to document their models' known or estimated energy consumption. We build an attestation pipeline for your workloads that measures energy per workload and per token and signs the records at the source, so each figure can be checked against its signature. It is built per engagement; no public example is published yet.

• · Per-workload / per-token energy measurement
• · Machine-signed attestation records
• · Regulator-ready disclosure documentation

Provenance you can verify

Content Provenance & Integrity

Prove where your content, data and model outputs came from. We build signed provenance chains from capture to publication, signed with ML-DSA-65 through Cryspen's libcrux, built per engagement (no public example is published yet), with a manifest format aligned to the C2PA claim model.

• · Signed provenance chains, capture to publication
• · Signatures with ML-DSA-65 (FIPS 204), tested in our own suite against the Wycheproof vectors
• · Manifest format aligned to the C2PA claim model

A wrong answer, repaired and re-testable

AI Answer Reliability

When an assistant gives a wrong answer because it read a superseded document, we reproduce the failure, agree with your team what a correct answer looks like, repair one agreed cause, and leave regression checks you can rerun. One workflow at a time, in the environment you choose. Unclear cases go to a person.

• · A reproduced baseline and a reviewed set of expected answers
• · A bounded repair, or a written finding that no repair is feasible
• · Regression checks your team can rerun when documents or models change

Scope, stated up front: this is engineering assistance, not a guarantee of accuracy. Results apply to the tested workflow and cases, and your domain owner approves the expected answers.