Strict configuration
Bounded parsing rejects duplicate members, malformed encoding, non-standard numbers, and unknown fields before startup.
Security & trust
Controls, evidence,
and the gaps between them.
Hormuz documents what the alpha enforces today, what the deployment must own, and what still requires independent proof.
Software stageAlphaNot production-ready
Routine telemetryContent-freeSchema-bound
Provider keysServer-sideNot sent to employees
Independent reviewOpen gateNot yet completed
Data handling
Keep the control record. Leave the conversation out.
Hormuz inspects request material transiently where policy requires it, while routine ledgers retain bounded operational evidence rather than the content itself.
Data classCurrent handlingRoutine evidence boundary
Prompts & responsesRelayed transiently in memoryNot written to routine usage or security telemetry
Employee credentialsValidated at HormuzNever forwarded to model providers
Provider credentialsServer-side environment or managed custody boundaryNever distributed to employees
Usage & costBounded identity, model, token, status, and cost metadataNo prompt or response body
DLP evidenceRule, action, outcome, and bounded countsNo matched value or raw request material
Current controls
Designed to fail closed at the boundary.
Origin-bound egress
Remote provider endpoints require HTTPS, credential-bearing URLs are rejected, and provider redirects are never followed.
Pre-provider enforcement
Identity, policy, budgets, privacy settings, DLP, and approvals are resolved before the governed provider call.
Revocable access
Short-lived sessions, atomic refresh rotation, replay-family revocation, and secure client credential custody.
Open enterprise gates
No trust badge can close these.
They require real customer-environment work, operational proof, or an independent party—not another marketing claim.
- 01Customer-specific TLS and network boundary
- 02Deployment-specific custody and retention
- 03HA, failover, backup, restore, RPO, and RTO proof
- 04Representative customer DLP evaluation
- 05Independent security assessment and penetration test
Security review
Bring your actual control requirements.
We will separate existing Hormuz evidence, customer-owned controls, and genuinely open engineering work.