Trust

The promises are load-bearing.

Most platforms tell you what their AI won't do. We removed the ability.

Deleting your files isn't forbidden — the operation doesn't exist. There is no delete on the surface your Host can reach, so there is nothing to bypass and no permission to skip. Revealing your keys to your AI isn't restricted — there is no code path. Your Host uses a credential by asking a broker to act with it; the bytes never enter its reach.

A guarantee is only structural if removing it means rebuilding. That is the bar we hold, and it is why these read as absences rather than rules.

And because a promise you can't verify is just marketing

The platform continuously asserts its own load-bearing properties — end to end, from the position of a real caller, on a timer — and pages us the moment one stops being true. Not a test suite that ran once at build time: tripwires that run against production, forever. When we fix something load-bearing, we add a tripwire for it. Fixed once, asserted forever.

Some of what is asserted, continuously

No token is ever billed
If an inference or embedding charge ever landed on a wallet, this tripwire goes red permanently. The only meter is compute.
A Host cannot reach another tenant
Isolation from platform internals and from other tenants is asserted from a real pod's position — independent of any network policy.
There is no anonymous identity
A connection without a client certificate cannot make a call. Identity is the certificate; a forged id is refused.
Permissions are proven, never claimed
A permission slip is a signature over its terms. Alter one term and it stops verifying. Revocation is checked offline, and a stale revocation view fails closed.
The operation surface is a fixed list
An unknown operation is refused at the gateway and on your machines. There is no arbitrary-execution path to harden, because there is no arbitrary execution.
Provenance is issued, never self-declared
Third-party code cannot be signed as first-party. The signing authorities are disjoint, and the tripwire goes red if they ever overlap.

What it doesn't do

This isn't an audit, and we won't call it one. These are our own checks, running against our own production, and we'll tell you exactly what they cover.