EthicVault is the deterministic governance layer between AI and the real world. Every action is measured, proof-bound, and validated in strict order — then passed, audited, or blocked. Same input, same verdict, every time. In software for the enterprise, and in silicon at the edge.
Candidate action
wire.transfer.execute · $2.4M
Deterministic verdicts
Mean decision latency
ASIC average power · pre-silicon
Policy-bound governance
Our Policy Compiler turns your board-approved policies — not a new framework — into a deterministic execution boundary. Purpose-built for the sectors that answer to a mandate.
From the moment a model proposes an action to the moment that action touches the world, custody never leaves the architecture — measured, classified, decided, and proven.
Untrusted domain
Resonance Engine
Friction Gate
Policy Engine
WORM Audit Chain
Every AI output is scored — in a single decision — against both an approved reference and a prohibited one, with embedding-space distortion corrected first. Outputs that merely look on-topic are separated from those that are genuinely aligned.
A three-tier deterministic classifier — PASS, AUDIT, BLOCK — computed in fixed-point arithmetic against frozen thresholds. Hard-veto priority is non-negotiable by design.
The only component with authority to decide — and it acts exclusively on proof-bound state after schema, proof-anchor, and replay validation succeed, in strict order.
Every verdict is serialized, hashed, and anchored under a Merkle root in write-once storage. Years later, an examiner replays any decision byte-for-byte.
Probabilistic guardrails give different answers on different days. EthicVault's verdicts are mathematical functions of frozen state — reproducible byte-for-byte, years later, in front of an examiner.
Architecture protected by pending U.S. patent applications — method and silicon.
basis points
Floating-point ambiguity is eliminated at the boundary: every governance variable is scaled to integers over 0–10,000. The same submission produces the same bits on any CPU, GPU, or JIT backend.
ordered validations
Schema → proof anchor → replay. The policy engine contains no code path that reaches threshold evaluation without all three succeeding — failure anywhere is an architectural BLOCK.
Every output is scored against both — the verdict follows the margin.
High coherence with the approved reference, low with the prohibited — a wide, clean margin. The action passes.
Controlled ablation
Same held-out set, same broad calibration, same architecture. One variable changed: whether the output is scored against an approved reference alone, or against an approved and a prohibited one in the same decision.
Single reference
Four prohibited cases cleared the gate while every legitimate one passed. The surface metric shows nothing wrong.
Dual reference
Every prohibited case blocked, with no legitimate case lost. The second reference is what closed the gap.
From the internal technical evidence report: a controlled experiment on a synthetic held-out set, prototype stage, limited sample. It is directional evidence for the architecture, not an operational accuracy estimate, and no independent party has reproduced it.
03 · Assurance
Deploy on-premises, air-gapped, or in a single-tenant private VPC. Customer data never trains models, keys stay yours, and every verdict is anchored in tamper-evident storage. Read the security brief →
Not yet audited — report at GA
Built to the control set — not certified
Article 32 measures by design
Evidence toward your obligation
04 · The Silicon Line
A software guard shares its processor with the model it polices. Our hardware line moves the gate into the die: an execution restrictor sits electrically in series with the actuation path — non-conducting by default, completing the circuit only on a proof-bound approve disposition.
Power figures are pre-silicon estimates from an open-PDK 130 nm flow, not silicon measurements: 1.382 mW active, 7.23 µW clock-gated idle, and under 1 mW as an average over a specified duty cycle. The FPGA platforms are static-leakage dominated and are not sub-1 mW.
The restrictor sits in series with the stimulation driver — a therapy pulse physically cannot fire without an approve disposition. Reversible fail-closed latch with audited re-arm.
AI driving-policy commands traverse the gate before the actuator bus. A blocked command drops the vehicle into a fail-operational safe state; every disposition is recorded.
Powered entirely from the reader field: transaction authorization is withheld unless the on-die risk model's output clears validation. No battery, no network, no override.
Where this stands
It runs
The gate was built on Xilinx hardware, then built again on Intel hardware — a different company, a different manufacturing process. It was given 330 test cases. Both gave the same answer to every one.
The chip is drawn
The layout is finished: about half a millimetre across, under a milliwatt to run. Every automated check a foundry requires before it will make a design came back with zero errors.
It has not been made
No wafer has been produced. The size and power figures come from the finished design, not from a chip anyone has held. We would rather you read that here than discover it later.
Engineered for regulated environments
We're onboarding a select group of regulated institutions. Apply for early enterprise access and receive a private technical briefing with our engineering team.