Surfil
// security & trust

Zero-trace by construction, not by promise.

Your security team doesn't have to take our word for anything on this page. The architecture makes the guarantees; the signatures make them checkable - offline, with no account.

surfil · guard - simulate → enforce
Protection rules
Secret firewall
Injection scoring
Command blocking
Sandbox isolation
highInjected tool-call via retrieved doc0.82 → blocked
The invariants

Four rules the architecture enforces

Each of these would require rebuilding the product to break - which is the point.

Zero-trace

Your source code never leaves the device. Telemetry and dashboards are built entirely from metadata - event names, hashes, timestamps - never file contents. If a string could reveal source, it doesn't leave.

Signed outputs

Every paid operation produces a server-signed output (Ed25519), with key epochs so a compromised key never invalidates history. This is the anti-bypass root - no client-side licensing shortcut.

Honest claims

Never "certified". No static or fixed injection rates, and no published savings percentage. Cost is a measured fact reported in tokens and signed into a receipt you can verify offline.

One layer

A single interception point, by design (the One-Layer rule). Surfil never chains a second competing proxy to sell you more - one pipeline, staged: security → cost → quality → observability → memory.

Architecture

Device → edge → data: what each plane sees

The trust model in one walkthrough. The plane that sees your code never talks to the internet about it; the planes that talk to the internet never see your code.

1

Device - where the work happens

What runs here

The Rust runtime: adapters, the single interceptor, the staged pipeline, the Weave engine and a local buffer. Guard inspects tool calls, Cap prunes context, Mind stores memory - all here.

What it sees

Sees everything: your source, your prompts, your tool calls. That's exactly why it never leaves this plane.

2

Edge - stateless workers

What runs here

Cloudflare Workers handling auth, entitlement, ingest, metering and signing. Batches arrive over mTLS, signed, with idempotency keys. No state, no storage of your content - cost stays flat per user.

What it sees

Sees metadata only: event names, counts, durations, hashes, token totals. Never a line of code, never a prompt.

3

Data - three stores, three jobs

What runs here

D1 for entitlement, devices, credits and the audit chain. Postgres (RLS-isolated) for identity, dashboards and memory ciphertext. R2 for evidence bundles and releases.

What it sees

Sees ciphertext and metadata. Memory is E2E-encrypted before it arrives - Surfil cannot read it, architecturally.

ⓘ Device and edge speak over mTLS with signed batches and idempotency keys. Passthrough to model providers is byte-exact - the provider prefix hash is preserved and asserted in CI.
Data handling

What lives where

Every category of data, its location, and the mechanism - not the policy - that protects it.

DataLocationProtection
Source codeOn-device onlyNever transmitted - architectural
Prompts & completionsOn-device onlyInspected locally by Guard; not stored
Memory / factsSyncedCiphertext (E2E) - we can't read it
TelemetryEdgeMetadata only (counts, durations, model names)
Identity & billingEdge / PostgresRLS-isolated per tenant
Threat model

What we defend against, and how

Fail-closed on every security path: when in doubt, the action doesn't run.

Secret exfiltration

Secret firewall blocks keys and tokens pre-flight, on-device.

Prompt injection

OWASP-scored on every tool-call; high scores blocked, all logged.

Malicious tool-calls

Sandbox isolation plus a human-approval gate on high-risk actions.

Key compromise

Epoch key rotation; historical signatures stay valid; dual-controlled.

Tampering

Admin actions land on a tamper-evident hash chain, verified on schedule.

Bypass

Signed-output root of trust - no client-side licensing shortcut exists.

Compliance

Evidence, not badges

We won't say “certified” - we give your auditors something better: evidence they verify themselves.

Offline-verifiable evidence

Charter maps controls (SOC 2, EU AI Act) into signed evidence bundles your auditors run surfil verify against - no network call, no account, no trusting a vendor dashboard.

Enterprise stack →

Subprocessors

CloudflareEdge compute, R2 storage
SupabaseIdentity, ciphertext, dashboards (RLS)
VercelHub hosting
StripeBilling
The exit

Exit is a feature

Clean uninstall restores every agent config byte-for-byte and leaves zero residue - verified, not promised. Export your Weave anytime with surfil export; receipts stay verifiable offline after you leave.

FAQ

What security teams ask first

Does my code ever leave the device?

No. Zero-trace is the architecture, not a toggle. If a feature needs your code off-box, we don't ship it.

How do I verify a signed output?

surfil verify <id> - offline, no account. Public keys for every epoch ship with the verifier.

Are you certified?

No - and we won't claim it. We provide offline-verifiable evidence and measured facts instead of badges.

Bring this page to your security team

We'll walk them through the offline verifier live - and they can run it themselves before the call ends.