Verillian runs on your hardware. It seals its record under your keys. It never receives your data. Most of what a vendor usually asks you to take on faith simply isn't here. This page holds the rest: what we align to, how it's built, what we won't claim, and the paperwork your review will ask for.
Aligned, not certified: Verillian builds to these controls, and whatever your framework calls the final word, certification, authorization, or attestation, it stays yours to earn in your own environment.
Six properties do most of the work, and every one is a fact of the architecture rather than a line in a policy document.
On-prem, private cloud, or fully air-gapped: the governing layer and the record both live inside your boundary, and nothing about running them depends on us.
There's no Verillian cloud for your traffic to pass through. Prompts, responses, and records never reach us, which removes a whole class of vendor risk before the questionnaire even starts.
Each ruling is signed on the device that made it and linked into a chain, so the record you show an assessor carries its own proof of integrity.
Records are encrypted under your institution's key. Anyone you authorize can verify they're intact, but reading them takes the key, and we never have it.
Anything you haven't allowed is refused, and a request the policy can't make sense of is refused too, rather than guessed at. The safe answer is the built-in one.
If policy can't be checked or the record can't be written, AI stops. An action you couldn't prove afterwards is one that doesn't run.
Every control has edges, and a security review deserves them up front rather than in a footnote. Here are ours.
It screens the identifiers your policy flags, from record numbers to name patterns, before a prompt leaves the device. Like any redaction, including one done by a careful human, it is best effort, and everything it caught is visible in the record.
Pre-execution tool blocking runs on the Anthropic API format today, the format Claude and Claude Code speak, with more bindings arriving by signed configuration. The other providers your policy names, ChatGPT among them, are captured and sealed into the same chain, screened where the format allows, their tool calls recorded rather than refused. A provider your policy doesn't name isn't governed at all, so deployment starts by naming yours. Ask about a provider and you'll get a straight answer.
Flipping the switch refuses the next connection and the next call everywhere at once. A response already streaming finishes on its own, and nothing new starts until you say so.