Security Posture
Data custody stays with the Client. Offline verification is first class. No telemetry by default. Built for paranoid operators.
Design Posture
01 Air-Gapped Capable
No outbound internet required for runtime operation. Deploy in classified or isolated environments without modification.
02 Zero Telemetry
No phone-home behavior. No usage metrics. No license servers. The binary runs without external communication.
03 Client-Owned Keys
Private keys are injected at runtime via environment or HSM. No keys stored, transmitted, or escrowed.
04 Verification Purity
Verification is a pure function. Same inputs always produce same outputs. No hidden state.
Threat Model
In Scope
- Tamper detection after seal creation
- Non-repudiation of sealed events
- Offline verification without vendor
- Cryptographic binding of metadata
Out of Scope
- Prevention of event fabrication before sealing
- Key compromise at the client
- Physical security of deployment
- Application-layer vulnerabilities
Breach Simulation
DEFCON MODETry to tamper with a sealed record. Click any field to modify it. Watch the cryptographic verification fail in real-time.
See It In Your Environment
The Proof Sprint puts 0REI's security model to the test with your real data, your infrastructure, your threat model.
Security Documentation
Full Security Posture Document
Complete threat model, design constraints, custody boundaries, and operational security guidelines.