Skip to content

Architecture

Where each part runs, and what crosses the line.

One architectural decision does most of the work: the control plane is ours and the data plane is yours. Everything else follows from refusing to move evidence across that boundary.

Solid lines carry evidence and stay inside the customer boundary. Dashed lines cross it and carry only orchestration, health and billing — never a prompt, a record or a key.

The layers

Every component, and whose environment it lives in.

  • Capture

    TypeScript / Python SDKs · GitHub Actions, GitLab, Jenkins · LiteLLM / Portkey / Cloudflare AI Gateway · OpenTelemetry

    Instruments five choke points rather than two hundred frameworks. That is how the install stays under an hour.

    yours

  • Ingestion

    Rust · Redpanda / NATS JetStream

    Absorbs bursts on a durable queue so capture never blocks and nothing is lost under load.

    yours

  • Evidence engine

    Rust · BLAKE3 / SHA-256 · ML-DSA-65 + Ed25519

    Canonicalises, hashes and hybrid-signs every change. The trust-critical core, and the reason it is Rust.

    yours

  • Transparency log

    Google Trillian / Sigstore Rekor

    Append-only, signed tree heads, RFC 6962 lineage. Reused, never hand-rolled — a bespoke Merkle log is how you ship a subtle break.

    yours

  • Stores

    PostgreSQL · S3 / MinIO · ClickHouse · OpenSearch

    Right tool per job: lineage graph, evidence blobs, cost analytics, estate-wide search.

    yours

  • Governance & automation

    Open Policy Agent · Temporal · Jira / Confluence / ServiceNow / Slack / PagerDuty

    Decides what each change needs, then does it. This is where “nobody writes the documentation” actually happens.

    yours

  • API & dashboard

    GraphQL / REST · Next.js · OIDC / SAML SSO · SCIM · RBAC

    Search, lineage, reports, and a one-click verifiable audit export.

    yours

  • Orchestration

    Managed · signed config, pulled by the data plane

    Fleet health, updates, licensing and billing. Carries no customer evidence or PII — by construction, not by policy.

    ours

Trust

Who has to be honest for this to work.

The useful question about any evidence system is not what it proves but who it still requires you to trust. Here is the honest answer, including the parts that are uncomfortable.

Three parties removed, three remaining. The remaining column is not empty and will never be — a system claiming zero residual trust is claiming something no system achieves.

Failure model

What happens when something breaks.

An infrastructure product is bought or rejected on this table more than on any feature.

CooL is unreachable
Your inference is unaffected — capture is never in that path. Events queue; what cannot be queued is counted, and the count is written as a signed entry so loss is recorded rather than silent.
The capture agent crashes
Your application keeps serving. Capture is out-of-band and non-throwing by construction: the call is an array push.
The enclave measurement changes
A different signing key is derived, and receipts pinned to the old measurement stop verifying against the new one. That is the intended alarm, not a bug.
RA-TLS peer fails attestation
The channel never opens and nothing is transmitted. Fail-closed toward the network, fail-open toward your application.
The log operator misbehaves
Detectable by an external witness — which is not built. Today, against a determined insider at CooL, the log alone is not sufficient. This is Gate 2 and it is not claimed.
A signing algorithm is broken
Records carry ML-DSA-65 and Ed25519, both required. A break in one family does not forge a record.

Deployment

One artifact, three topologies.

The same package runs all three. We never fork the product per customer — the thing that quietly kills enterprise infrastructure startups.

Multi-tenant SaaS

SMB and mid-market who want to start today

Managed control and data plane, with per-tenant cryptographic isolation.

Single-tenant VPC (BYOC)

Most enterprises

Data plane runs in the customer's own cloud; we manage the control plane. Their data never leaves.

On-prem / air-gapped

Defence, government, top-tier finance

Full stack via Helm, with zero outbound calls.

The evidence path

And here it is again, at the record level.

The inference path (top) never passes through CooL. Capture is asynchronous and fail-open; the verifier sits outside the trust boundary on purpose.
Verify a record yourselfRead the security model