Principles

These four principles are not tunable. They are why the product can be pointed at production.

OSS tools do the work; the LLM decides

Deterministic open-source tools produce the raw results. The LLM plans and interprets, and its calls are minimised. This keeps runs reproducible and cost bounded.

Proof-driven

No HIGH or CRITICAL exploitation finding is delivered without a reproducible proof of exploit. Deterministic detections - SCA, secrets, misconfiguration, licences - are delivered as they are, because the detection is itself the proof. A finding you cannot reproduce is not reported as one.

Hard guardrails

Nothing is scanned outside an authorised perimeter:

• Ownership proof before any scan.
• Rules of engagement (RoE) and scope-lock: the scan stays inside the hosts and paths you authorised.
• Non-destructive by default, with a kill-switch.
• Everything traced in an audit trail.

EU-first, single model path

All model access goes through one EU-resident router (residency and zero-data-retention are enforced as a hard guardrail), never a direct vendor SDK. Data stays in the EU by construction.