Loading
About
CooL exists because the interesting question about an AI system is not what it did but whether you can prove what it did — to a regulator, to a customer, or to yourself six months later when something has gone wrong and nobody remembers the change that caused it.
Principles
These are engineering constraints rather than values-page adjectives. Each one rules something out, which is the only test of whether a principle is real.
Capture is asynchronous, out-of-band and fail-open. CooL adds zero latency to inference, and if CooL is down the customer's AI keeps serving.
Removes the objection that kills infrastructure deals: “what happens when your thing breaks?”
Control plane — orchestration, billing, updates — is ours. Data plane — evidence, prompts, PII — lives in their VPC or on-prem. The split is architectural, not a policy promise.
This single decision is what makes CooL sellable to a regulated enterprise at all.
The same Kubernetes/Helm package runs as multi-tenant SaaS, single-tenant VPC, or fully air-gapped on-prem.
We never fork the product per customer — the thing that quietly kills enterprise infrastructure startups.
Transparency log, policy engine and durable workflows are solved problems with mature open-source implementations. We build only the layer that is genuinely ours.
Engineering spend goes almost entirely into differentiated IP instead of re-solving solved problems.
Always classical and post-quantum together — ML-DSA-65 with Ed25519, ML-KEM with X25519.
Post-quantum schemes are too young to bet uptime on. Hybrid means a break in either one is survivable.
Honesty
Two of seven verification domains do not pass today, and both are named on the homepage rather than in a footnote. The readiness ladder below is public, and the build fails if the copy claims a rung above the one we are on.
This is not modesty. A company selling evidence has exactly one asset, and it is that its statements can be checked. The moment we round simulated up to pass in a slide, every other number we produce becomes something you have to verify independently — at which point you may as well use somebody else's product.
So the rules are in the code rather than in a style guide. The verifier will not report a hardware pass without a hardware root. The site's CI will not build with an over-claim in it. Neither can be talked around.
The company