Trust center
What we run, what we claim, and what we do not.
The security policy in the repository says which controls are automated and which are human review, and claims nothing it does not run. This page is the same posture, for the people who sign.
Posture by area
Architecture
- One signed binary of about 75 MB in Rust and CUDA. No Python, no PyTorch, no runtime compilation in the request path.
- Recipes, models and kernels delivered as signed artifacts. Kernel targets content hashed down to their transitive include closure.
- Release images promoted by digest from staging to canary to production, never rebuilt between environments.
- The control plane is out of band. It never sits on the synchronous inference path.
Data handling
- Prompts, weights, outputs and telemetry stay on hardware you own, in your cloud account, or on an air gapped network.
- Prompt and output logging is configurable and off by default in enterprise deployments.
- In bring your own cloud, no inference request leaves your account. The control plane sees configuration, licensing, versions and aggregate telemetry.
- Air gapped installs from local media, with telemetry exported on your schedule or never.
Assurance
- Cargo deny audits dependencies for advisories, license compliance and banned crates on every pull request and weekly.
- Every kernel change carries a certified benchmark before it merges. Every release passes the serve matrix on the real box.
- There is no automated static analysis of CUDA kernel sources. Kernel memory safety is human review plus the runtime kernel audit, and we say so.
- SOC 2 readiness documentation, model risk documentation and pinned recipe governance packs are part of the first SLA engagements. Ask for the current state of the audit program.
Licensing
- Community Edition under AGPL-3.0-only. Contributions are covered by a CLA that permits Enterprise relicensing.
- Enterprise Edition under a commercial license, per GPU per year, with terms your legal team can read in one sitting.
- Third party names on this site belong to their owners and appear for background or as primary sources, never as endorsements.
Responsible disclosure
Do not open a public issue for a vulnerability. Email [email protected] with a description, reproduction steps, environment and the affected component. We acknowledge within 48 hours and give an initial assessment within seven days, then merge the fix, tag a release and credit the reporter unless anonymity is requested.
Questions
The questions we actually get asked.
Short answers. Each one is backed by something on this site or in the repository.
Who owns the data?
You do. Prompts, weights, outputs and telemetry stay on hardware you own, in your cloud account, or on an air gapped network. The control plane manages configuration, licensing, versions and aggregate metrics, and it never sits on the request path. In a bring your own cloud deployment no inference request leaves your account.
Can it run air gapped?
Yes. The engine is one binary with no runtime download and no Python environment to resolve. Recipes, models and kernels are delivered as signed artifacts and installed from local media. Telemetry can stay entirely inside the network and export on your schedule, or never.
Does it run in my cloud account?
Yes. Bring your own cloud deploys the engine and router into your AWS, Azure or GCP account, on your GPU node pools, through Terraform or Helm. The control plane sees configuration, licensing, versions and aggregate telemetry, and nothing else. Regulated buyers can run the customer pull GitOps mode, where Metrale never holds credentials to your account.
What about SOC 2 and compliance?
The architecture is built for regulated buyers, and SOC 2 readiness documentation, model risk documentation and pinned recipe governance packs are part of the first SLA engagements. Ask for the current state of the audit program when you book. We will tell you exactly where it is.
Ask the rest in a working session, or read the deployment guide ↗.
Next step
Send the security questionnaire.
We answer it the way this page is written, control by control, with what we run and what we do not.