SEAL OF SIGMUNDSECURITY DESK

DATA HANDLING · ARCHITECTURE PREVIEW

Your source enters for one purpose.
Only bounded evidence remains.

Follow a repository snapshot through authorization, isolated analysis, minimization, encryption, and customer-controlled access. Every stage distinguishes implemented foundations from controls still being completed and evidenced.

Implemented foundation Planned privacy control

THE PROTECTED DATA CONDUIT

Seven boundaries. One deliberately narrow path.

Scroll through the stages or select one directly. The diagram follows the currently described architecture; it is not a claim that every planned privacy control is live.

REPOSITORY DATA PATH01 / 07
Protected repository data conduitSeven sequential chambers represent authorization, immutable commit selection, temporary acquisition, isolated analysis, minimization, encryption, and customer controls.01Authorize02Freeze03Acquire04Isolate05Minimize06Encrypt07ControlCUSTOMER AUTHORITYRETAINED EVIDENCE
ACTIVE BOUNDARY · 01You choose the repository

Current authorization boundary

  1. 01Implemented foundation

    You choose the repository

    An authenticated, authorized customer selects one GitHub installation and repository. The control plane retains verified identity and scope—not repository source.

    Current authorization boundary
  2. 02Planned privacy control

    One exact commit is frozen

    Acquisition resolves an immutable commit before analysis so the object being assessed cannot silently drift during the run.

    Publication waits for exact-SHA evidence
  3. 03Planned privacy control

    Access expires behind the snapshot

    A narrowly scoped installation token exists only for its bounded acquisition task. It does not continue through the analysis pipeline.

    No ambient repository credential
  4. 04Planned privacy control

    Analysis runs inside a sealed chamber

    The source snapshot is processed in an ephemeral Sandbox with denied network egress and without inherited customer or production credentials.

    Plaintext exists only where analysis requires it
  5. 05Implemented foundation

    A trusted filter admits the result

    A deterministic reducer converts bounded scanner output into a closed receipt. Source, tokens, temporary paths, and operational exhaust are not admitted.

    Reducer contract proven with synthetic inputs
  6. 06Implemented foundation

    Retained evidence becomes a capsule

    Each retained receipt is envelope-encrypted with a per-record data key. Storage holds ciphertext and a wrapped key—not the plaintext data key.

    Separate managed key boundary
  7. 07Implemented foundation

    Viewing and deletion are authorized events

    An authorized vault operation returns an inert no-store view. The retained encrypted receipt can be removed through an explicit customer deletion path.

    Retention wording remains prelaunch

THE IMPORTANT DISTINCTION

Isolation protects processing. Encryption protects retention.

01

Plaintext is temporarily necessary

Authorized analysis must read source inside the isolated runtime. We do not describe that as end-to-end encryption or zero knowledge.

02

Boundaries carry different authority

Identity, acquisition, analysis, reduction, key management, and storage do not share one ambient credential.

03

Public claims follow evidence

A control moves from commitment to verified only after implementation, denial testing, and linked operational evidence.

TRANSPARENCY, NOT SECURITY THEATER

Trust should be inspectable.

This page will mature with the architecture. Limitations remain visible until the corresponding controls are proven.

Return to SEAL OF SIGMUND →