Trust model
Trust is a boundary, not a badge.
Ember Aegis states where its guarantees stop. Findings stay on this instance, access is administrator-provisioned, and the product reports its own readiness honestly rather than presenting every module as finished.
Where data lives
Local-first is a storage decision, not a marketing line.
- Storage
- Findings and evidence stay on this instance. No cloud sync.
- Upload egress
- Uploaded bytes are analysed locally and never forwarded.
- Analytics
- None. No third-party scripts, pixels, or beacons.
- Encryption
- Durable evidence is sealed with AES-256-GCM at the store boundary.
- Sessions
- Secure, same-origin cookies. Tokens are administrator-issued.
Self-reported readiness
This instance reports 3 full-slice (route present or better), 10 partial, and 0 missing modules on its own readiness page. A route being present is wiring, not production proof; a partial module says so on its own surface rather than pretending to be complete.
A product that hides its unfinished modules is asking you to trust a claim it has not earned. The readiness matrix is generated from the code, not written by hand, and it is visible to every authorized operator.
How to read this
Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.