Regnant
Products/01 · CordonIn Production

Cordon.

Exfiltration is architecturally impossible.

Cordon is the sovereign foundation every other Regnant system runs on. No data, query, weight, or result ever crosses the institution's perimeter. Not a privacy policy, a set of technical constraints enforced from a hardware root of trust to a client-verifiable, Merkle-chained audit log.

Currently deployed in

Financial institutions and government agencies across East Africa.

01Containment02Verifiability03Sovereignty04Auditability
Regnant · SYSTEM RECORDSystem№ 01 / 07
L4L3L2L1↖ weights ●egress: denied at L1outside: sees nothingLAYER 01silicon / root of trust
● weights: inside, ownednested walls. L1 → L4✕ egress: architecturally denied
Plate I: containment, drawn to scale of intentRegnant · Sovereign AI · Dar es Salaam

Architecture

Scroll down to bedrock.

Four layers, each one enforcing the one above it. The page you are reading descends the same way an auditor would: from the log they can verify, down to the silicon that makes it true.

Fig. 1. Section A–A through the enforcement stack · not to scale · all layers load-bearing

L4 / Application layer

Offline-Verifiable Audit Log

  • Ed25519-signed Merkle chain
  • Every query, response, and state transition recorded
  • Client verifies the entire chain without internet access

The layer the auditor sees. Everything below exists so this one can be trusted.

Fig. 1. Section A–A · sheet 1/4↓ L3 below
L3 / Model layer

Encrypted Model Weights

  • AES-256-GCM symmetric encryption
  • Client-held key hierarchy: the vendor cannot decrypt
  • Per-deployment key rotation with zero-knowledge proof

Provisioned once, owned forever. We hand over weights we can never read back.

Fig. 1. Section A–A · sheet 2/4↓ L2 below
L2 / Compute layer

Trusted Execution Environment

  • AMD SEV-SNP encrypted memory isolation
  • Intel SGX v2 enclave execution, where available
  • ARM TrustZone secure-world partitioning

Inference runs inside memory no other process: or operator, can inspect.

Fig. 1. Section A–A · sheet 3/4↓ L1 below
L1 / Silicon

Hardware Root of Trust

  • TPM 2.0 cryptographic attestation
  • Secure Boot with verified firmware chain
  • dm-verity read-only root filesystem validation

Bedrock. Containment is enforced here: in hardware, not policy.

Fig. 1. Section A–A · sheet 4/4Datum: bedrock

L4, running: not pictured

Don't trust the audit log. Check it.

"Offline-verifiable" is a provable claim, so this page proves it: a live Merkle chain, hashed and re-checked by your own machine, no internet required.

SHA-256 via your browser's WebCrypto · in production every link is also Ed25519-signed

  1. 0001QUERYinference request received…
  2. 0002RESPONSEinference result returned…
  3. 0003STATEmodel weights attested (TPM 2.0)…
  4. 0004QUERYinference request received…
  5. 0005APPROVALhuman decision recorded…
  6. 0006STATEkey rotation completed…

The chain above was hashed live when this page loaded. Try to catch it lying.

Who runs it

01

Central banks

Sovereign monetary policy intelligence with zero exfiltration risk.

02

Defence intelligence

Classification-aware analysis that never leaves the wire.

03

Critical infrastructure

Decision systems for energy, water, and telecommunications.

On-premise handover

What the institution receives.

They own the roadmap. We hand over the system: not a rental.

  1. 01Encrypted model weights: provisioned once, owned forever
  2. 02An open, auditable inference runtime
  3. 03A key hierarchy the institution alone holds
  4. 04An air-gap option for fully offline operation
  5. 05Update timing, testing, verification, and approval, the institution owns the roadmap

Built on this ground

Knott →

Knott runs every AI decision privately on Cordon.

Wallgarden →

Wallgarden is built on Cordon's containment guarantees.

Matta →

Matta grounds Cordon's inference in verified facts.

Next system · 02/07

Knott→Workflow Orchestration