Skip to content
Menu ▾
Patent pending

Security review

The page your security function can forward.

Every answer a review committee asks for in the first ten minutes, stated completely: where it runs, what leaves, who holds the keys, what code is inside, and what happens when the license ends.

Deployment facts

Where does it run?

On your machines, in your estate, including entirely disconnected environments. The control surface is reachable only from within the deployment.

What leaves the building?

In the default mode, nothing. There is no outbound call of any kind. Where independent time evidence is used, the underlying content remains within the customer environment.

Who holds the keys?

You do. Signing keys are generated within your deployment, never transmitted, and never escrowed with us.

Is air-gapped operation a configuration?

No. It is filed as architecture. No egress, no account, no dependency on any network. The guarantee is structural rather than configured.

What third-party code is present?

A small set of permissively licensed libraries implementing published mathematics: Ed25519 to RFC 8032, SHA-256, RFC 3161 timestamping. License texts ship with the software. Using audited public implementations is deliberate: an opposing expert checks the mathematics against a public reference, which is a stronger position than a private one.

Verification and continuity

Who can verify a record?

Anyone holding the file, with public mathematics, free and permanently. No account, no license, no call to any service we operate. Verification is a capability of the record itself.

What happens if the license ends?

Every record already issued remains valid and independently verifiable, permanently. A lapsed license stops covering new records. It never reaches backwards.

What third-party assurance exists?

The mathematics is the assurance: signatures to RFC 8032, hashing to SHA-256, timestamps to RFC 3161, each checkable against public references. Patent pending across the estate.

What does it establish?

It records authorship and review at the moment they occur, and it verifies them for anyone holding the file, permanently and without contacting us. Certification of compliance and admissibility are determined by a court or a regulator, which is where those determinations belong.

The one-sentence summary for the forward

The kernel does not observe the work. It records the decision about the work, on your machines, with your keys, and enforcement and evidence signing require no network egress.

Licensing begins with the problem, not the product.

Describe the system, what it decides, and what it would cost you to be unable to prove it. A written scope follows before any call.

Ways to begin:

hello@regulayer.com