On-prem deployment. Your text never leaves your infrastructure.
Every commercial AI detector routes buyer text to their servers — the exact compliance wall that blocks Turnitin at K-12 and Grammarly Enterprise in the EU. We deploy the detector inside your VPC, your air-gapped datacenter, or your existing container host. Signed license, hardware-bound, tamper-evident audit log.
Tier 1 · VPC deployment
Deploys inside your existing AWS / GCP / Azure tenancy via Terraform. You own the compute, the network, the audit logs.
- Runs in a private subnet, no public inbound
- Internal load balancer · optional PrivateLink
- Customer-owned CloudWatch / Cloud Logging / Azure Monitor
- Auto-scaling: 1–100 instances based on request rate
- License heartbeat over HTTPS out of your DMZ
~1 day of Terraform · SLA: 99.9%Tier 2 · Hardened container
Signed OCI image runs on your existing container host (Docker, Kubernetes, Nomad). All modules AOT-compiled and license-bound.
- All executable modules AOT-compiled to native
- Symbols stripped, control-flow flattened
- License-bound to your host's hardware fingerprint
- Ed25519-signed audit log to any log sink you already run
- License refresh cycle 90 days
docker run truthai/detect + license fileTier 3 · Air-gapped
Fully offline. No heartbeat, no phone-home, no outbound network. License installed at delivery, valid for the contract term.
- Zero outbound network required
- Time-boxed license installed by physical delivery or bootstrapped from a signed USB
- Optional Intel SGX / AMD SEV-SNP / AWS Nitro Enclave attestation
- For classified, defense, or offline research environments
- Compliance evidence packet included at delivery
api.trigeochiral.com while on-prem tiers are staged for institutional buyers. Every institutional
contract at the site-license tier includes an on-prem deployment engagement scoped at signing. Tier 1 (VPC)
is available now with a ~1-day Terraform install once your cloud team is ready. Tiers 2 and 3 ramp in
2–4 weeks depending on your host environment.
| FERPA (US education) | GDPR (EU) | HIPAA (US health) | EU AI Act Art. 12 | Air-gap install | |
|---|---|---|---|---|---|
| Turnitin | DPA + parental notice | DPA required | Not available | No signed log | No |
| GPTZero | DPA required | DPA required | Not available | No signed log | No |
| Grammarly Enterprise | DPA required | DPA required | Limited BAA | No signed log | No |
| Copyleaks / Originality.ai | DPA required | DPA required | Not available | No signed log | No |
| Truth-in-AI on-prem | Never leaves VPC | Data-residency in your region | BAA on request | Ed25519 tamper-evident log | Yes (Tier 3) |
EU AI Act Article 12 (transparency and logging for high-risk AI systems) has been in force since August 2, 2026. See Case 08 for the full compliance narrative.
Every arrow inside the dashed box stays inside your VPC. The only outbound traffic is the license heartbeat — a single HTTPS request every 24 hours to our license server. In Tier 3 (air-gapped) that arrow is removed and the license is installed by delivery.
- Signing algorithm
- Ed25519 (RFC 8032). Every license file signed by our production private key. Signature verified at container start.
- Hardware fingerprint
- Composite of
MAC(primary NIC) || motherboard UUID || install-time salt. Fingerprint bound at first-boot and pinned to the signed license. Container refuses to run on any other host. - License file contents
{organization, product_tier, hw_fingerprint_sha256, issued, expires, quota_per_month, signature}. Human-readable JSON with an Ed25519 signature block.- Heartbeat (Tier 1 & 2)
- Single HTTPS request every 24 hours to
license.trigeochiral.com. Payload:{hw_fingerprint_sha256, container_version, license_id, request_hash}. No text, no scores, no metadata about detections. Response: signed continue-token valid for 48h. - Grace period
- Detector continues to serve at full performance for 30 days after last successful heartbeat. Warning banner in API response after 7 days silent. Refusal after 30 days silent, with an on-container
/renewendpoint for offline re-license. - Air-gap variant (Tier 3)
- License installed at delivery. No heartbeat. Time-boxed to contract term. Renewal via signed USB bootstrap or authorized personnel visit.
- Audit log
- Every scoring request emits an Ed25519-signed log line:
{ts, request_hash, score, detector_version, signature}. Log lines chain viaprev_hash— tamper-evident under EU AI Act Article 12. - What we can see from our end
- Heartbeat metadata only: hardware fingerprint hash, container version, license id, heartbeat count. We never see text, scores, or user identities. Fully documented in the DPA.
Do you ship us source code?
No. Every module ships AOT-compiled to native shared objects. Detector internals are not readable from the container. What you can inspect are the interfaces (HTTP endpoints, log format, license verifier) — everything you need to integrate and audit, nothing that would compromise our IP.
Can we run this fully offline?
Yes — Tier 3 (air-gapped) is designed for exactly that. No heartbeat, no phone-home, no outbound network. License is installed at delivery, valid for the contract term. Optional TEE attestation (Intel SGX, AMD SEV-SNP, AWS Nitro) for buyers who need cryptographic guarantees that the container has not been modified.
What happens if your license server goes down?
Nothing, for 30 days. The container carries a 30-day grace window after last successful heartbeat. After 7 silent days, API responses include a warning banner. After 30, the detector refuses new requests but exposes an on-container /renew endpoint for offline re-license.
Does the heartbeat send our text?
No. The heartbeat payload is metadata only: hardware fingerprint hash, container version, license id, heartbeat count. It does not include text, scores, or any information about the detections you've performed. Fully documented in the DPA. Wireshark it if you like.
What's the DPA / MSA / BAA situation?
Standard DPA is on request and matches Anthropic/OpenAI-tier language for enterprise buyers. HIPAA BAA available for healthcare deployments. FERPA-compliant deployment guide included with every institutional license. EU AI Act Article 12 compliance packet included at delivery.
Which cloud do you support first?
AWS Terraform module is the primary reference implementation. GCP and Azure modules ship within 30 days of a signed contract that specifies them. Kubernetes (EKS / GKE / AKS / self-hosted) supported via a Helm chart.
What about latency?
Sub-10 ms per document on a modest CPU (see Case 07). Because there's no GPU, no LLM inference, and the whole detector is CPU-cache-warm after the first request, you get consistent latency without cold-start penalties.
Do you require Kubernetes?
No. The container runs on any OCI-compatible runtime (Docker, containerd, Podman, Kubernetes, Nomad, ECS Fargate, Cloud Run, Container Instances). Tier 1 uses whatever container orchestration your cloud already exposes.
Can we integrate with our SSO / IAM?
Yes. The detector authenticates callers via bearer tokens issued by your IdP (Okta, Azure AD, Google Workspace, Ping, custom OIDC). No user identity data ever leaves your VPC.
How does this square with the trigeochiral.com hosted API?
The hosted API is the fastest way to try the detector and validate the response format. Institutional buyers move to on-prem at contract signing — often keeping the hosted API for internal dev/test alongside the on-prem production deployment.
On-prem engagements are scoped during procurement. Send us a note with your cloud, your compliance regime, your expected volume, and your timeline. We'll return a technical scoping doc and a signed proposal.