SystemsCRDNPrivate inference server

Cordon. Sovereign inference, signed at the source.

Runs your language model on your own hardware, and signs every answer.

How it works · CRDN

A request's journey. Through one door.

Every request passes one check after another inside your boundary, and the answer leaves signed, so anyone can check it offline.

One accountable way in

01 / 07MTLS

An enrolled client asks

Mutual TLS identifies the caller from its enrolled client certificate. There is one way in.

Read the figure as text

An enrolled client asks. Mutual TLS identifies the caller from its enrolled client certificate. There is one way in.
A stranger is refused. A caller without an enrolled certificate is refused at the gate. It never reaches policy, the record or the model.
Policy before inference. Model permissions, prompt limits, token budgets and rate limits are checked before the model is asked.
Logged before processing. The request is written to the record first, so even a request that fails later is accounted for.
Inference on loopback. The supervised runtime is bound to loopback, unavailable as a second public endpoint.
Filtered, then signed. Output rules redact, truncate or block, on streaming responses too. Then the canonical response is signed.
A record anyone can check. The answer leaves with its signature and the entry joins the chain. Both verify offline, without the serving node.

Enrolled client: A system or person enrolled with a client certificate. Its identity travels with every request.
Unknown client: Anything that has not been enrolled. It never reaches the model.
Client identity: Mutual TLS identifies enrolled clients. This is the only way in.
Refused: No certificate, no request: refused before policy, before the model, before anything is kept.
Policy & admission: Model permissions, prompt limits, token budgets and rate limits are checked before inference.
Pre-write audit: The request is written to the record before the model sees it.
Local runtime: A supervised local runtime generates the answer, on your machine, behind the control plane.
Output filter: Output rules redact, truncate or block content, on complete and on streaming responses.
Signature: The canonical response is signed, so a client can verify it offline.
Hash-chained record: Signed, hash-chained audit entries can be verified without contacting the serving node.

The receipt

Every answer leaves signed. Check it without us.

The signature covers the request, a hash of the output, the model, the time and the measurement of the environment that ran it. A client, or anyone it hands the receipt to, verifies it offline with the node's public key, without trusting the server that produced it.

Response signature

CORDON_RESPONSE_v1
|{request_id}
|{output_hash}
|{model_id}
|{timestamp_ms}
|{mrenclave}

signature: Ed25519 over the line above
verify:    offline, with the node's public key

Fields as signed by cordon-api. The audit log stores hashes, never prompts.

Deployment modes

Choose the trust boundary. Laptop to air gap.

Above Light, each mode needs a hardware root of trust with pinned measurements. Attestation has not yet been run on confidential hardware; the README says so.

Mode	Where	Outbound	Models arrive	Root of trust	Identity
Light	A laptop or a development server	Allowed	Pulled from Hugging Face	None required	Mutual TLS optional
Sovereign Cloud	Your own cloud account	Allowed	Pulled, then sealed	SEV-SNP or TPM 2.0, pinned	Mutual TLS required
Vault	A regulated data centre	None	Encrypted bundles, management channel	SEV-SNP or TPM 2.0, pinned	Mutual TLS required
Island	A private network, no management channel	None	Physical media	SEV-SNP or TPM 2.0, pinned	Mutual TLS required
Dark	An air-gapped rack	None	Physical media	SEV-SNP or TPM 2.0, pinned	Mutual TLS required

From a laptop

Pull a model, run it behind the door, check the install.

cordon

cordon pull HuggingFaceTB/SmolLM2-360M-Instruct-GGUF
cordon run smollm2-360m-instruct-gguf

cordon doctor

Try it · CRDN

Alter one entry. Watch the chain break.

Six entries, each holding the hash of the one before it. Alter any of them and every link after it stops matching. The hashes here are a toy computed in the page; the shape of the guarantee is the point.

Audit chain · examplehash(prev + entry)

01client=knott model=qwen2.5 admit47145b56
02client=knott output=redacted sign9cd431be
03client=matta budget=ok admit83aff940
04client=matta output=complete signd4a258a5
05client=wallgarden rate=ok admit10988048
06client=wallgarden output=truncated sign12e8fbd3

Not yet checked

What it is

The model is only part of the deployment.

For organisations that have to run AI inside their own network. Cordon sits between your applications and the model: it identifies each caller by certificate, writes the request to a signed log before the model reads it, filters the answer and signs it, so anyone can check it later without trusting the operator.

Who can use it, which data it can release, and how you reconstruct a request matter just as much. Cordon supervises the local model runtime behind a single control plane, with the runtime bound to loopback so it cannot be reached as a second public endpoint.

Sourceregnant-io/cordon

Running a model inside your own network?

Say what it should do, which data it can touch and where it has to run. A person replies by email.

Talk to us about Cordon All systems