Data sovereignty
Run a memory on infrastructure Chordian does not own — and cannot read.
Most "private AI" offerings are single-tenant hosting: the vendor still holds your data, just in a separate database. Chordian's own-infrastructure mode is architecturally different — the memory engine runs on your machine. Chordian orchestrates and bills it, and stores none of the knowledge.
The seven layers
| Layer | Control | Defeats |
|---|---|---|
| 0 — Credential hygiene | Install credentials held only for the install window, then purged. Box keys generated on the box and never transmitted | Vendor-side credential theft |
| 1 — Network | WireGuard tunnel; a single UDP port open on your host | Wire sniffing, internet-facing surface |
| 2 — Transport | Mutual TLS 1.3 from first boot; both ends present certificates | An attacker already on the tunnel subnet |
| 3 — Isolation | Per-box namespace, network policy admitting only the tunnel | Cross-tenant blast radius |
| 4 — At rest | Your disk encryption plus a key generated on the box | Disk theft; vendor decryption |
| 5 — Supply chain | Signed images, verified before install | Tampered or substituted images |
| 6 — Sovereignty | Content in a box-local ledger | Vendor retention, subpoena, vendor breach |
Why mutual TLS is the one to notice
WireGuard encrypts the pipe. Mutual TLS authenticates the caller.
Without it, anything that reached the tunnel subnet could talk to the box unauthenticated — which turns one compromised hop into full access. With it, a request arriving without a valid certificate is rejected outright:
certless request → 400 No required SSL certificate was sent
with certificate → 200 OKEnforced from first boot: the certificate is issued before the memory service starts, so there is no plaintext window during installation.
The threat model
| Threat | Outcome |
|---|---|
| Passive network eavesdropping | Encrypted UDP only |
| Attacker on the tunnel subnet | Rejected — needs a CA-signed client certificate |
| Chordian is breached | No customer memory, no SSH keys, no box encryption keys |
| Your box disk is stolen | Useless without the box key — which Chordian does not hold |
| Tampered image | Rejected before it runs |
| Compromised tunnel hub | Cannot authenticate to a box on its own |
| Subpoena served on Chordian | No stored content to produce |
Honest boundaries
Connector OAuth credentials are currently held platform-side, envelope-encrypted with a Vault-held key, because the OAuth redirect completes on the platform. Everything you actually put into memory is on your box. Moving these credentials to the box is planned.
Air-gapped install is validated — the box installs with no calls to public registries; the image and bundle stream over the secure channel.
Air-gapped processing depends on your model configuration. In the default proxy mode, content transits Chordian's proxy to the model vendor. In bring-your-own mode it reaches only the provider you already trust. A fully in-box model is roadmap.
A sovereign box with no egress configured fails loud rather than falling back to a public API. Chordian's own vendor keys are deny-listed from ever reaching a box.
Operations
| Capability | Behaviour |
|---|---|
| Active only when reachable | A box is marked active only after a real round-trip succeeds — no "healthy but silently broken" state |
| Disconnect and reconnect | Sever the tunnel; the box and its data stay on your server |
| Permanent delete | Tears down the box, its volumes and the tunnel |
| Audit | Every provision, disconnect, reconnect and decommission logged with actor and outcome — never with credentials |
| Self-healing tunnel | A reconciler re-syncs peers and prunes orphans after control-plane restarts |