Regulayer Enterprise licensing
Main site The engine By problem What is licensed Deployment Assurance AI audit trail Human authorship and review The record format What it proves Security review Begin with the problem

Security review

The page your security function can forward.

Every answer a review committee asks for in the first ten minutes, stated plainly and completely: where it runs, what leaves, who holds the keys, what code is inside, and what happens when the licence ends.

Deployment facts

Where does it run?

On your machines, in your estate, including entirely disconnected environments. The kernel binds the loopback interface and refuses any client that is not local.

What leaves the building?

In the default mode, nothing. There is no outbound call of any kind. Where independent witnessed time is required, a single cryptographic digest is sent to a public timestamp authority under RFC 3161. Never the file, never its contents, never a name.

Who holds the keys?

You do. The signing key is generated on your own machine on first run, and it is never transmitted and never escrowed with us.

Is air-gapped operation a configuration?

No. It is filed as architecture. No egress, no account, no dependency on any network. The guarantee is structural rather than configured.

Can our engineers read the source?

Yes. It ships readable by design, so your security function can satisfy itself line by line. Reading is granted under licence; redistribution and derivative works are not.

What third-party code is present?

A small set of permissively licensed libraries implementing published mathematics: Ed25519 to RFC 8032, SHA-256, RFC 3161 timestamping. Licence texts ship with the software. Using audited public implementations is deliberate: an opposing expert checks the mathematics against a public reference, which is a stronger position than a private one.

Verification and continuity

Who can verify a record?

Anyone holding the file, with public mathematics, free and permanently. No account, no licence, no call to any service we operate. Verification is a capability of the record itself.

What happens if the licence ends?

Every record already issued remains valid and independently verifiable, permanently. A lapsed licence stops covering new records. It never reaches backwards.

What third-party assurance exists?

The mathematics is the assurance: signatures to RFC 8032, hashing to SHA-256, timestamps to RFC 3161, each checkable against public references. The estate is eighteen patent filings and a PCT, patent pending. The software is early in its deployment life, and we say so.

What does it establish?

It records authorship and review at the moment they occur, and it verifies them for anyone holding the file, permanently and without contacting us. Certification of compliance and admissibility are determined by a court or a regulator, which is where those determinations belong.

The one-sentence summary for the forward

The kernel does not observe the work. It records the decision about the work, on your machines, with your keys, and nothing of the work leaves the building.

Licensing begins with the problem, not the product.

Describe the system, what it decides, and what it would cost you to be unable to prove it. A written scope follows before any call.

Ways to begin:

A scoped pilot, inside your estate, on your machines. An architecture briefing, for your security function, one hour. The diligence pack: the record format and the estate, in writing. The problem itself, in your own words.

hello@regulayer.com