Pre-Execution Tool & Egress Gates
Every shell command, file write, git push, and outbound HTTP request is evaluated against tenant-specific Rego policies before execution—with deterministic secret and PII redaction.
Zero-Egress Sovereignty · OPA Pre-Execution Gates · SLSA v1.0 Provenance
Cryptographic Governance, Tenant Isolation & Zero-Egress Sovereignty
Explore Mindaeon's 6-layer security architecture: Open Policy Agent (OPA) pre-execution tool gates, SHA-256 hash-chained audit ledgers, OpenBao Transit KMS, PostgreSQL 18 RLS, and the 1,091 MiB single-host Sovereign Appliance.
Architecture Diagram · 6-Layer Zero-Trust Execution & Cryptographic Governance
OPA Rego · Host Verification Gate · SHA-256 Audit Ledger · SLSA v1.0
Defense-in-Depth · Zero-Trust Execution
Cryptographic Governance & Air-Gapped Sovereignty
Built from day one for financial institutions, defense contractors, healthcare networks, and critical infrastructure operators that cannot send proprietary source code to unverified third-party clouds.
Tamper-Evident Audit & Attestations
All agent tool invocations, prompt hashes, AST mutation scores, and human approvals are chained in a SHA-256 ledger and signed with OpenBao Transit Ed25519 keys across 9 compliance frameworks.
Single-Host Air-Gapped Deployment
Deploy the entire Mindaeon stack (Keycloak, PostgreSQL 18, Gitea, SeaweedFS, Control Plane, OpenBao, Edge, OPA) inside a disconnected enclave on a single Linux VM or bare-metal server.
Zero-Trust Execution Pipeline
6-Stage Cryptographic Enforcement Boundary
Every prompt, file read, shell invocation, and generated patch passes through deterministic security boundaries before touching your repository or model provider.
Deterministic Secret & PII Redactor
Scans prompts, environment variables, and tool outputs for API keys, PEM certificates, JWTs, and regulated PII before any outbound model call.
Open Policy Agent (OPA) Rego Gate
Evaluates every tool invocation against version-controlled Rego policies—blocking destructive commands, unauthorized network egress, and protected path edits.
Out-of-Sandbox Test & Mutation Guard
Runs outside the agent's writable mount to guarantee agents cannot delete failing tests, inject .skip, or weaken assertions to fake green builds.
SHA-256 Hash-Chained Audit Trail
Appends every session event to an immutable hash chain signed via OpenBao Transit (Ed25519), enabling instant tamper detection across the entire workspace history.
Ed25519 Signed Releases & SLSA v1.0
All 11 client binaries and Sovereign Appliance images are signed with production key release-prod-2026-01 and ship with CycloneDX SBOMs.
Zero-Training & Air-Gap Guarantee
Mindaeon never trains models on customer code. Deploy in US/EU isolated cloud regions or run 100% disconnected on the 1,091 MiB Sovereign Appliance.
Enterprise & Sovereign Procurement
Request Our SOC 2 Type II, ISO 27001, HIPAA, or Air-Gap Security Packet
Connect directly with a Mindaeon Solutions Architect for air-gapped Sovereign Appliance bundles, dedicated customer-VPC deployments, SOC 2 / HIPAA / FedRAMP security packets, or multi-seat volume licensing.
Ready to Ship Verified Software?
Provision Your Isolated Organization or Request an Air-Gapped Appliance Review
Self-serve cloud trial workspaces include 5 seats, $5.00 in usage credits, dedicated PostgreSQL Row-Level Security, and immediate access to all 6 client surfaces.