Zero-trace by construction, not by promise.
Your security team doesn't have to take our word for anything on this page. The architecture makes the guarantees; the signatures make them checkable - offline, with no account.
Four rules the architecture enforces
Each of these would require rebuilding the product to break - which is the point.
Zero-trace
Your source code never leaves the device. Telemetry and dashboards are built entirely from metadata - event names, hashes, timestamps - never file contents. If a string could reveal source, it doesn't leave.
Signed outputs
Every paid operation produces a server-signed output (Ed25519), with key epochs so a compromised key never invalidates history. This is the anti-bypass root - no client-side licensing shortcut.
Honest claims
Never "certified". No static or fixed injection rates, and no published savings percentage. Cost is a measured fact reported in tokens and signed into a receipt you can verify offline.
One layer
A single interception point, by design (the One-Layer rule). Surfil never chains a second competing proxy to sell you more - one pipeline, staged: security → cost → quality → observability → memory.
Device → edge → data: what each plane sees
The trust model in one walkthrough. The plane that sees your code never talks to the internet about it; the planes that talk to the internet never see your code.
Device - where the work happens
The Rust runtime: adapters, the single interceptor, the staged pipeline, the Weave engine and a local buffer. Guard inspects tool calls, Cap prunes context, Mind stores memory - all here.
Sees everything: your source, your prompts, your tool calls. That's exactly why it never leaves this plane.
Edge - stateless workers
Cloudflare Workers handling auth, entitlement, ingest, metering and signing. Batches arrive over mTLS, signed, with idempotency keys. No state, no storage of your content - cost stays flat per user.
Sees metadata only: event names, counts, durations, hashes, token totals. Never a line of code, never a prompt.
Data - three stores, three jobs
D1 for entitlement, devices, credits and the audit chain. Postgres (RLS-isolated) for identity, dashboards and memory ciphertext. R2 for evidence bundles and releases.
Sees ciphertext and metadata. Memory is E2E-encrypted before it arrives - Surfil cannot read it, architecturally.
What lives where
Every category of data, its location, and the mechanism - not the policy - that protects it.
| Data | Location | Protection |
|---|---|---|
| Source code | On-device only | Never transmitted - architectural |
| Prompts & completions | On-device only | Inspected locally by Guard; not stored |
| Memory / facts | Synced | Ciphertext (E2E) - we can't read it |
| Telemetry | Edge | Metadata only (counts, durations, model names) |
| Identity & billing | Edge / Postgres | RLS-isolated per tenant |
What we defend against, and how
Fail-closed on every security path: when in doubt, the action doesn't run.
Secret exfiltration
Secret firewall blocks keys and tokens pre-flight, on-device.
Prompt injection
OWASP-scored on every tool-call; high scores blocked, all logged.
Malicious tool-calls
Sandbox isolation plus a human-approval gate on high-risk actions.
Key compromise
Epoch key rotation; historical signatures stay valid; dual-controlled.
Tampering
Admin actions land on a tamper-evident hash chain, verified on schedule.
Bypass
Signed-output root of trust - no client-side licensing shortcut exists.
Evidence, not badges
We won't say “certified” - we give your auditors something better: evidence they verify themselves.
Offline-verifiable evidence
Charter maps controls (SOC 2, EU AI Act) into signed evidence bundles your auditors run surfil verify against - no network call, no account, no trusting a vendor dashboard.
Subprocessors
Exit is a feature
Clean uninstall restores every agent config byte-for-byte and leaves zero residue - verified, not promised. Export your Weave anytime with surfil export; receipts stay verifiable offline after you leave.
What security teams ask first
Does my code ever leave the device?
No. Zero-trace is the architecture, not a toggle. If a feature needs your code off-box, we don't ship it.
How do I verify a signed output?
surfil verify <id> - offline, no account. Public keys for every epoch ship with the verifier.
Are you certified?
No - and we won't claim it. We provide offline-verifiable evidence and measured facts instead of badges.
Bring this page to your security team
We'll walk them through the offline verifier live - and they can run it themselves before the call ends.