Trust & architecture
Security at PAI
This page is written for the engineer your CXO asks to check us out. Sections per 06-WEBSITE-AND-PRICING §4.
Architecture
Two halves with a deliberate boundary:
┌──────────────────────────────────┐ ┌──────────────────────────────────────┐ │ YOUR DEVICE / POD │ │ JARVIS CONTROL PLANE (our SaaS) │ │ agent runtime · model gateway │ Tailscale/ │ ingest (verify sig + chain) │ │ local Postgres (memory, RAG, │────mTLS────▶│ fleet registry · policy studio │ │ documents, local audit) │ metadata │ cost analytics · anomaly engine │ │ governance daemon (signs every │ only* │ dashboards · approvals · alerts │ │ action; enforces policy) │ │ │ └──────────────────────────────────┘ └──────────────────────────────────────┘ * at the default telemetry dial
No public inbound ports on the device. Management traffic rides the tailnet; each device is ACL-tagged so it can reach only our ingest endpoint — never another customer's device.
What leaves your premises
Controlled by the telemetry dial, enforced on-device (client-side) before anything is sent:
| Dial setting | Leaves the device | Never leaves |
|---|---|---|
| metadata (default) | Action class, tool name, timestamps, cost, autonomy level, hash-chain headers, success/failure | Message bodies, document content, recipient lists, API keys |
| redacted | Metadata + redacted summaries (entities masked) | Raw content, API keys |
| full (explicit opt-in) | Metadata + action summaries for richer audit search | API keys — never, at any setting |
Crypto design
- Device identity: Ed25519 keypair generated on-device at enrollment; private key never leaves the device (TPM/Secure Enclave where present).
- Audit trail: every event carries a sequence number and the SHA-256 hash of its predecessor — a hash chain. Gaps and rewrites are detectable; the verifier is open source.
- Policy & updates: policy bundles and software updates are signed; the device refuses unsigned or expired bundles and fails closed (default-deny).
BYOK key handling
Your AI provider keys are entered by you, on your device, during onboarding. They are stored encrypted in the on-device model-gateway vault, are never transmitted to Demystify, never appear in logs or telemetry (CI-enforced scrubbing), and per-agent budget caps are enforced at the gateway.
Our access
Demystify support access to your tenant is scoped, time-boxed, requires a recorded reason, and emits a customer-visible audit event. You can see every access we ever made in your dashboard's support-access log. Our own support actions are hash-chained too.
DPDP mapping DRAFT
| DPDP concern | PAI posture |
|---|---|
| Data fiduciary | You — your business data stays on your device/pod. |
| Data processor | Demystify, for governance telemetry only (metadata by default, minimizing scope). |
| Consent | Telemetry dial and channel communications consent captured at onboarding. |
| Breach notification | 72-hour internal SLA runbook. |
| Grievance | Grievance contact published on this site. |
Full DPA template available on request (DRAFT — pending legal sign-off).
Responsible disclosure
Found a vulnerability? Email security@dmstfy.com. We acknowledge within 48 hours, commit to a fix timeline within 7 days, and credit researchers who report in good faith. Critical agent-runtime CVEs are patched fleet-wide within 72 hours of disclosure. DRAFT — policy text pending sign-off
What we stand on
The third-party stack is open source and inspectable. We only ship components under Apache-2.0/MIT-class licenses; local models are Apache-2.0 or MIT only. The full SBOM (generated per release) is published here alongside each golden-image version.
| Component | Role | License |
|---|---|---|
| Agent runtime (OpenClaw) | Agents + chat channels | OSS (see SBOM) |
| Org/governance layer (Paperclip) | Org chart, budgets, approvals | OSS (see SBOM) |
| Model gateway (LiteLLM) | BYOK routing, budget caps | OSS (see SBOM) |
| PostgreSQL + pgvector | Memory, RAG | PostgreSQL / OSS |
What we built
Everything above is other people's work, and we say so. The part that makes a Pie governed rather than merely useful is ours — and it is the reason this product exists.
| Ours | What it does | Status |
|---|---|---|
| Governance plane | Every action a Pie attempts passes one gate: kill switch → per-Pie pause → policy → autonomy floors → approval. Nothing routes around it. | Shipped |
| Autonomy floors | payment.* and data.delete are pinned to ask-a-human in code — not a setting, not a default. You cannot configure them away. | Shipped |
| The audit chain | Ed25519 over RFC 8785 canonical JSON, hash-linked. Money is integer micro-USD, never a float — two verifiers must agree on a total we signed. | Shipped |
| Offline verifier | Checks a chain with no network and no account with us. A record you can only verify by asking the vendor is not evidence. | Shipped |
| Driver Record | The chain projected onto one named human — what they decided, signed, portable, verifiable after they leave. | Shipped |
| The spec, Apache-2.0 | Driver Record schema + chain format + the verifier — the thin layer, so the evidence outlives us. | Committed, not yet published |
On the last row, plainly: the thin layer is committed to Apache-2.0 and is not published yet. Until it is, treat it as intent, not as something you can go and read. Everything above it — this control plane, the fleet and mentor consoles, provisioning, licence issuance — is not open source and is not planned to be.
What we publish
Demystify Systems maintains an open-source platform toolkit on npm, MIT-licensed, used across our products: @demystify/rag (grounded retrieval with citations and abstention), @demystify/extract (documents → structured data), @demystify/events (outbox, idempotent consumers, DLQ), @demystify/gateway-sdk, @demystify/platform-contracts, @demystify/platform-observability, @demystify/platform-profiles, @demystify/platform-state and @demystify/voice-client.
Not yet part of a Pie. These are published and real, but no Pie currently depends on them — wiring rag, extract, events and per-driver metrics into the pod is planned work, not shipped work. They are listed here because they are ours and they are open, not because they are running on your box today. When that changes, they move into the table above and the capability list will say so.