The trust model, spelled out
Every vendor says data is safe. Few write it as a table with two columns, one of which lists what the vendor can do. This is ours.
What we can and cannot do
| We can | We cannot |
|---|---|
| See which companies are customers, with plan and version | Enter an instance as a user: platform issues no credentials for instances |
| Read numeric metrics (requests, latency, GPU) | Read users, documents, conversations, file names |
| Forge or revoke a licence | Install software: releases are signed with a key that never sits in the cloud |
| Offer an already signed version or MCP server | Switch on features that send data out: those are enabled only from the instance panel |
| Issue a certificate for an instance name, only in the borc technical domain mode | Hijack the instance name when it sits on the customer's own domain |
Why the company network is not the trust boundary
Saying "the instance is only reachable from the LAN" is not enough, for four reasons:
- everyone inside the network is there: employees, VPN consultants, any infected PC. With forgeable credentials, any of them would get in as the CEO;
- for support we often have VPN access to the customer: our credentials plus our network access would be complete access;
- in the technical domain mode borc controls DNS for the name, and could point it at its own server with a valid certificate;
- security questionnaires ask whether the vendor can access the data, and "only if it is inside your network" is not accepted.
That is why identity lives in the instance, why the instance itself verifies the corporate login against the customer's Entra or Google, and why platform never holds the user list.
Egress is switched on from your side only
Web search, external model, MCP servers with outbound addresses: none of it can be switched on from the cloud, neither by a feature flag nor from the catalogue. It is switched on from the instance administration panel, with a log of every call. The machine firewall blocks the rest.
And the software we ship? We write it, and a malicious release signed by us could read data. That trust point cannot be removed: it is limited by a signing key that never sits in the cloud, reproducible releases published with notes, images pinned by digest, no downgrades, and manual approval of updates for those who ask.