Deploy connected, private or air-gapped, and keep the kill switch

The appliance is packaged as a hardened, minimal container image with an installer for a single host, and a Helm chart for Kubernetes. There is an air-gapped route for environments with no outbound access at all. Installation includes verify and uninstall scripts, and the installer is designed to leave the runtime with the least privilege it can do the job with.

Two database roles are used. One owns the schema and is used only by a one-shot migration step. The other is the runtime role: it cannot bypass row-level security, owns nothing and has only the permissions it needs. The service refuses to start if the runtime role owns any table, and database credentials arrive as files rather than as environment values.

Delivery through the cloud marketplaces is on the roadmap. <marketplace listings - founder to fill>.

A control you cannot check is a promise. The appliance has a command that verifies the audit chain and exits non-zero if the chain breaks or diverges from the signed checkpoint. A status command prints the mode, enrolment, kill switch state, link state and coverage summary, without customer content. A plain-language data inventory describes what the appliance knows about people, written for a works council or a data protection officer.

In connected mode a signed audit checkpoint also goes out through the outbox, so an off-box anchor exists. If you prefer that no anchor leaves, use private or air-gapped mode and keep the checkpoint yourself.

Retention is configurable. Personal data of accounts deleted from the directory can be replaced with a pseudonym after a period you set, and export and erasure for a single person are available commands. Each is audited without restating the values involved.

Start from your policy and not from convenience. If you permit a vendor-hosted control plane, connected mode gives the simplest operation, because health, coverage and diagnostics reach Swfte and signed commands can reach you. If your policy requires every control plane to be under your authority, choose private. If the environment cannot make any outbound connection, choose air-gapped and accept that updates come on signed media.

The choice is not permanent. The mode is a configuration, and the kill switch gives you a local way to stop the link in any mode that has one. Whatever you choose, the data stays in your environment by default, and personal and restricted data are not sent out.

We do not say that a deployment is compliant with any regulation. The platform provides the technical controls, governance mechanisms and evidence required to deploy AI within an organisation’s applicable regulatory, security and policy requirements. The exact posture depends on your use case, jurisdiction, deployment and configuration.

Swfte does not hold a SOC 2 report or an ISO 27001 certificate and does not sign HIPAA business associate agreements today. A SOC 2 Type I audit is in preparation; the trust page has the current status.

Specifics such as availability and pricing are not published here. Availability is <availability - founder to fill>, and pricing is <pricing - founder to fill>.