Request access · BBBLY

Talk to us. About Bubbly.

Say what the software should do, which data it can touch, the languages it has to work in and who approves the result. A person replies by email.

Where Cordon can run

LightA laptop or a development server
For trying Cordon and for low-sensitivity work. Bind it to loopback: without mutual TLS, anyone who reaches the port can claim to be any client.
Sovereign CloudYour own cloud account
A hardware root of trust with pinned measurements, a client-held master key, and outbound access only to fetch models.
VaultA regulated data centre
As Sovereign Cloud, with no outbound connections and response timing normalised. Models arrive as encrypted bundles, never by download.
IslandA private network, no management channel
As Vault, with nothing reaching the node over a network. Everything, models included, arrives on physical media.
DarkAn air-gapped rack
Single tenant, no network beyond the client subnet, and key custody declared at FIPS 140-2 Level 4.

What you can count on

Your hardware, your keys
The systems run on machines you control. Above Light mode, Cordon's keys derive from a master key held on your side, not ours.
Systems that work together
Matta, Wallgarden and Bubbly can each use one Cordon node as their model, and Wallgarden reads Matta's data-trust measures as metrics.
A record you can check
Decisions and approvals stay in the record. Cordon keeps a signed, hash-chained log you can verify without trusting the operator.