The dispatch pipeline, end to end

One governed tool call, end to end

The hash chain audit log design

A SHA-256 row chain checks that the sequence has no gaps. Ed25519-signed checkpoints chain through the previous signature, too. kid-based rotation fails closed on an unknown key. We report an unsigned tail and never hide it. We HMAC-commit actor identities. So GDPR crypto-shred erasure leaves the chain still verifiable. Signing runs through one custody choke point. We built a KMS or HSM seam, but the hardware side still needs to ship. The sealer holds an advisory lock. So the chain cannot fork.

Full verification rules and the report schema live on the verify page.

Data plane: tokenization at ingest

We tokenize datasets at ingest. The tokens are deterministic and HMAC-based. That makes them join-preserving. The same value always gets the same token. So joins, analytics, and entity resolution work. The tokens are also vault-reversible. Detokenizing is a privileged, logged act, never a default. Classification tags PII and PHI. Quasi-identifier generalization coarsens the risky fields. SQL views mask by default. That covers the path we leave raw.

The query engine is the DataShield Analytical DB, exposed over MCP. Our engineering blog covers how we measure speed. We publish benchmark numbers with the hardware, warm or cold state, and percentiles. Or we do not publish them at all.

Open components we build on

We name them so you can go check them. Cedar handles policy. Fastify runs the Auth layer. Hono runs the fleet layer. SQLite fits in where it can. All of it runs on Node 22. Analytical and transactional storage run on the DataShield Analytical DB and the DataShield Transactional DB.

Each stage of the MCP authorization pipeline above is in shipping code. The limitations below are the parts that are not.

Honest limitations

• No inline traffic interceptor. We are not a proxy on your prompt path. Protection sits in the data (turned to tokens at ingest) and at the MCP tool boundary. An agent that skirts governed surfaces finds no raw PII in governed data. But we do not see or filter arbitrary LLM traffic. Run a gateway for that. We coexist with all of them.
• LIKE on tokenized text doesn't work. Same-input tokens keep equality and joins, not substring search. We document this. It is by design.
• Guardian is v1.5.3 and Lighthouse v1.4.1. Both have run in production on our own infrastructure since April 2026. We say "in production", not "battle-tested".
• No SOC 2 yet. Our security posture, and its honest status, live on the security page.
• Detection is not our layer. Prompt-injection and jailbreak classification belong to detection vendors. We govern access and evidence underneath them.