Integrity AI Trust Center

Current status

Integrity AI is in internal development. This page describes its binding architecture. Release artifacts, checksums, and transparency logs will appear here with the first public release.

The Zero-Custody promise

Most compliance platforms work by collecting your evidence — screenshots, configurations, logs, system inventories — into the vendor's cloud. That makes the vendor a second copy of your most sensitive information, and a second place it can be breached.

Agenarys Integrity AI is built the opposite way. Every scan, every piece of evidence, and every diagnostic report is created and stored inside your own environment, on systems you control. What reaches Agenarys is limited to cryptographically signed metadata: hashes, signed status statements, and verification receipts. By architecture — not by policy — Agenarys cannot read, store, or lose your data, because it never has it.

What never leaves your environment

The platform is designed so that none of the following can be stored by, or transmitted to, Agenarys: your business records or customer data; protected health information; personal information; passwords; API keys; encryption keys; your files; compliance evidence; diagnostic reports; configuration files; secrets of any kind; audit evidence; system inventories; screenshots; or logs containing your information.

This is enforced in the software itself, at both ends of the connection: the agent in your environment refuses to transmit anything outside a small, published list of permitted metadata types, and the Agenarys cloud independently rejects anything outside that same list. A violation of this rule is treated as the most severe class of defect in our engineering process.

The only things we ever receive

Six classes of information can cross from your environment to Agenarys, and nothing else: signed metadata with a fixed, published structure; content digests (one-way hashes that cannot be reversed into your data); signed attestations of check results; trust receipts; Merkle tree roots and proofs; and validation status values such as pass or fail. The exact permitted structure is published on this page as a signed, versioned schema, so anyone can inspect precisely what can leave a customer environment.

How verification works

The Integrity Agent runs compliance checks locally in your environment and records each result in a local, tamper-evident ledger that you own. Each result is summarized as a short signed statement — the attestation — containing the check identity, the result, and a hash of the local evidence. Agenarys verifies the signature, checks the ledger's consistency, countersigns it with a timestamp, and returns a trust receipt to you.

The result: you hold the evidence and a receipt proving what Agenarys verified and when; Agenarys holds only hashes. An auditor can verify your records offline, without an Agenarys account, using the verification tool included in every audit bundle.

Your record survives your vendor

Because your ledger, evidence, and audit bundles live in your environment, they remain complete and verifiable even if Agenarys' cloud is unreachable — or gone. The agent continues scanning and recording fully offline. Connectivity affects only how quickly receipts arrive, never your capability or your record.

Attestations, not guarantees

Integrity AI provides attestations of compliance-check results — cryptographically verifiable statements about what was checked, when, and with what outcome. It does not provide guarantees of data security, and it does not make Agenarys the owner, processor, or custodian of your data. Data security remains your responsibility; our role is infrastructure provider, verifier, and attestation authority. Decision-support outputs are not legal advice.

Release integrity

Every distributed Integrity AI binary is cryptographically signed, and every release publishes its SHA-256 checksums, a software bill of materials, and build provenance so you can confirm that what you installed is exactly what we built. Release artifacts and checksum manifests will be published in this section with the first public release.

Transparency logs

Integrity AI operates public, append-only transparency logs: one for release artifacts and one for verification receipts (digests and timestamps only). Once an entry is logged, it cannot be silently removed or replaced. Log access and monitoring details will be published in this section with the first public release. Agenarys also runs Integrity AI on its own systems and publishes the resulting self-attestations here.

Security disclosures

To report a suspected security vulnerability in any Agenarys product, email hello@agenarys.com with the subject “Security Report.” Do not include customer data or secrets in a report. We acknowledge reports, investigate, and coordinate disclosure in good faith. A formal disclosure policy and security.txt will be published in this section.