Threat model
Boundaries, proof, and our limitations.
Written for a reader who is auditing us, not building with us. Everything here is a property of the architecture; the limitations are published because a threat model that omits them is marketing.
Trust boundaries
Three boundaries, one enforcement point at each crossing
REMIT trusts three lines: between a branch and the core, between your LAN and the appliance, and between the workflow author and your estate. Each crossing has one enforcement point and one direction.
| Crossing | Enforcement point | Direction |
|---|---|---|
| Intake relay to core (messages) | Data diode, or an allow-listed mTLS relay that only the relay may initiate | Inward only |
| Branch to core (private WAN) | Stateful firewall, allow-listed ports; the branch initiates both streams, the core never opens toward a branch | Both, with application-layer directionality |
| Branch to internet | No default route, sealed network configuration, egress probe fails closed | None permitted |
| Build enclave to core (workflows, weights, corpus) | Physical media through a quarantine host, or a one-way diode | Inward only |
| Core to auditor | Export to write-once or read-only media | Outward only |
| Anything to the build enclave | No inbound network interface exists | Impossible |
What the proof record proves
And what it does not
- That the procedure was followed: this record was produced by this workflow version, on this input, under this calibration, and the kept set is what the gate computed.
- That nobody altered it: the signature checks against a key whose history is itself a signed chain, and the chain head is anchored to write-once media.
- That the decision is re-derivable: scores, margin, kept set and the reviewer-signed rationale reproduce bit for bit from the stored record.
- That a specific decision was correct. The standard is a frequency across cases, not a promise about one.
- That the standard holds if your cases stop resembling the ones it was measured on. Under drift the bound is void; a stale calibration sends every case to a person.
- That the system is robust to someone deliberately shaping the input stream. The guarantee assumes live cases resemble past ones; an adversary who breaks that assumption is outside it.
The egress probe
How 0 of 225 is measured
- 1
On a schedule, the appliance attempts a connection to every endpoint on an enumerated list of 225 targets a cloud-native system would call: vendor endpoints, telemetry sinks, update servers, model registries, public DNS resolvers.
- 2
Every attempt must fail at the network boundary. Any success is an alert, and the result is written to the ledger, so the history of the gap holding is itself an auditable record.
- 3
Before go-live the probe must report 0 of 225 reachable. It is a gate in the install procedure, not a report.
A negative test proves only what was enumerated. The probe proves those endpoints are blocked; it does not prove no path exists. The stronger claim, that no route exists at all, is a network configuration fact your own network team verifies, of which the probe is evidence, not proof. The target list is published with the probe so that team can extend it.
The target list and procedure are published with the probe artifact; the list is not reproduced on this page. Until the probe ships, the reviewed list is published as a document and the count shown is the reviewed count, 225, derived from the enumeration — not a figure held constant.
Our limitations, published
What we would rather you hear from us
The list an infrastructure team will press on first. It is maintained; if it ever stops being maintained, that is itself a finding.
- 01
Reproducibility costs throughput.
To make the rationale reproducible bit for bit, the core model runs single-stream on a pinned build. Deferred cases are decided one at a time; that is a deliberate ceiling on how fast hand-offs are suggested.
- 02
One non-embedded dependency at the core.
Fifty concurrent reviewers plus branch replication exceed a single-writer store, so the core uses PostgreSQL. A PostgreSQL-free standard is possible with per-branch shards, at the cost of cross-branch reporting.
- 03
The vector store has a ceiling.
Fine for one bank; a consolidated multi-entity corpus needs a migration, with downtime and re-verification. Group customers should start on the larger store.
- 04
Data diodes are operationally fragile.
No retransmit, no error return; truncation is detected only at the final manifest check. Many customers will prefer an allow-listed relay, which is a policy-enforced gap, not a physical one, and which the egress probe does not test. Your network team reviews it.
- 05
Degraded mode is a quality dip, not equivalence.
When the core is unreachable, a branch keeps deciding within its licence and people resolve the rest with a small local model at best. No decision is lost and no standard is lowered; the deferred slice is slower and less assisted.
- 06
Identity integration is per bank.
Directory schemas, SAML attributes and certificate policies differ at every institution. We avoid an identity silo, which is right, but this is where deployment weeks go.
- 07
Anchoring is a human discipline.
If a site skips its daily anchor, the tail of its chain is unverifiable against truncation. The system alerts on a missed anchor; an alert is not a control. Shorter intervals are available at a cost.
- 08
Erasure versus retention is not settled law.
We erase by destroying a case’s data key and appending a tombstone; the record survives without personal data. Whether that satisfies a given regulator’s definition of erasure is confirmed per market, and it must never be presented as settled.
- 09
Multi-tenant isolation on shared hypervisors is approximate.
Per-line-of-business security domains on one hypervisor need per-domain key custody and ledger separation, which the current design approximates but does not guarantee.
- 10
Re-derivation over a decade needs the runtimes archived.
Each workflow pins its runtime hashes; someone must hold every runtime build we ever shipped, or the re-derivable-for-the-retention-period claim has a shelf life. Who holds it is agreed per deployment.
- 11
Clock discipline is assumed.
Ordering is by sequence and timestamps are advisory, but anchoring and calibration expiry need a monotonic clock. Sites with no time source degrade to local time and are flagged.
- 12
The probe is a negative test.
It proves the enumerated endpoints are blocked, not that no path exists. We will not present it as the whole air-gap argument.
Deployment validation
What your teams run before we go live
The operational counterpart to this threat model: what your own teams execute and check, grouped by who runs it, every item sourced to the specification. Nothing on it requires SG Systems to be present or trusted.
Network team
- No default route on the branch WAN interface; sealed network configuration
- Re-run the egress probe: 0 of 225 reachable is a go-live gate, and a negative test proves only what was enumerated
- Choose diode or allow-listed relay, and review the relay yourself: the probe does not test inbound policy
Security and key custody
- Branch signing key generated in the TPM 2.0; activation key in your HSM or on dual-control smartcards
- Disk recovery key split among your custodians, never held by SG Systems
- Unmasking personal data is a human, permissioned, audited act, never an API grant
Identity team
- Consoles registered against your IdP; REMIT holds no user accounts
- Integration principals are certificates from your own CA, carrying scopes and a named human owner
- A principal can never hold a REMIT role
Model risk and compliance
- Read the measured standard, automation rate and deferral rate before go-live
- Measure the deferral rate in shadow mode: it sizes the core hardware, before any is bought
- License auto-execution per outcome class, or not at all; policy changes are proposals that land in the next signed release
Go-live and after
- The go-live gate: image hash, key ceremony, dual-control activation, byte-identical smoke test, egress probe
- Daily anchoring is a human discipline; an alert is not a control
- Rehearse degraded mode as a quality dip, not equivalence; run the determinism check; decide who archives the runtimes
The checklist also states what is deliberately absent: no remote update path, no remote authoring of what the machine may decide, no cloud model egress, no public status page.
A step your team cannot complete is a step we will not go live with.
Read the full checklistObservability and status
No public status page, on purpose
There is nothing of ours running outside your perimeter to report on, so a public status page would be theatre. Inside the perimeter, all metrics, logs and traces are local: a Prometheus store with thirteen months of retention, dashboards per role, and alerts routed to your own channels. There is no remote write, no crash reporter and no update check. The egress probe result, anchor freshness and a periodic determinism check are metrics, and their history is written to the ledger.
A question this page does not answer?
We would rather hear it from your security team now than in procurement.