How we build
How we build
One doctrine runs through all three systems — VIGIL, RÉCOR, and APEX. It is written as things you can verify, not things you have to believe. Each principle below is a claim an evaluator can test against the system in front of them.
Capability is never authorization
Being able to do something is never permission to do it. Models, agents, plugins, imported results, and external tools never receive the power to declare their own permission or the truth of their own finding. Every consequential action passes a conjunctive, fail-closed chain of controls.
No finding is trusted until it is re-verified
An observation is a lead until an independent, deterministic authority re-verifies it into a fact. A confirmed fact is signed and re-checkable offline. Reports always separate what is proven from what is merely observed, and the absence of a signal is never reported as proof of absence.
The institution holds the keys
The institution controls its own hardware, keys, data, and reports. SIGIL has no default access, receives no operational telemetry, and holds no hidden administrative account. Where a usage right is revocable, that revocation is a signed certificate verified locally — never a remote channel into the deployment.
The institution can always read, export, and stop
Whatever a system's licensing state, the institution can always read and export its own data and always trip a safe stop. Revocation or expiry blocks new sensitive actions; it never blocks access to data, and it never prevents the institution from stopping the system.
Open standards, not lock-in
Where a standard exists, we build to it and export to it — so the institution's data is portable and outlives any one vendor. RÉCOR, the sovereign beneficial-ownership registry, exports to the Beneficial Ownership Data Standard; our systems ship signed builds with a software bill of materials.
Built to degrade safely, and to be audited
Controls fail closed: the absence of a control is a denial, not a default allow. Every consequential action is attributable in a tamper-evident audit trail, and every build is signed and accompanied by a bill of materials so what runs can be checked against what was shipped.
Why this matters for you
An institution should not have to trust a vendor's good intentions. It should be able to check. Everything above is written so that an evaluator, a regulator, or an auditor can put the system in front of them and confirm it — or find that it does not hold.