Built in Switzerland.
Hosted in Switzerland.
Cleared in Switzerland.

Applied work on customer data runs locally, on the deployment's own infrastructure. In sovereign mode nothing leaves it — including general knowledge queries. In Max Brain mode, knowledge questions that contain no customer data go to external model vendors; subprocessors are named per deployment. Where customer operations require it, deployments are entirely on customer premises with no outbound connectivity.

• FADP / revDSG-native
• Subprocessors named per deployment
• On-prem option · default
• Customer DPA on file

Founders, engineers, and Forward Deployed Engineers are Swiss citizens. Personensicherheitsprüfung (PSP) screening is conducted at the level the engagement requires — Grundsicherheitsprüfung for access to VERTRAULICH material, erweiterte Personensicherheitsprüfung for GEHEIM. No subcontracting outside Switzerland.

• PSP at engagement level
• Swiss-citizen FDEs
• No offshore engineering
• Background re-screen · annual

Customer-managed on-prem, or Swiss-jurisdiction infrastructure. Never US hyperscalers for regulated workloads. Hosting partners are selected for Swiss legal domicile, Swiss operations, and Swiss-citizen access controls.

• Infomaniak · Swiss-domiciled
• Exoscale · Swiss-domiciled
• Customer datacenter
• Air-gapped on-prem

Native support for Swiss classification levels under the Information Security Act (ISG). Markings propagate through the ontology — objects, properties, links, and actions all carry classification metadata. Purpose-based access controls enforce need-to-know.

• INTERN · routine
• VERTRAULICH · sensitive
• GEHEIM · classified
• Purpose-bound access

The path to formal certification is dated. Where a target is open, Ithildin states it is open. We do not claim certifications we do not hold.

• ISO/IEC 27001 · target Q4 2026
• IEC 62443 (OT) · target Q2 2027
• FINMA Circular 2018/3 · aligned
• SOC 2 Type II · commercial

Ithildin is built to run inside fully disconnected Swiss sites — including hardened bunker facilities. Updates are signed, packaged, and delivered over a one-way data diode by Ithildin Fortress. The site is never reachable from outside; the outside is never reachable from inside.

Every read, every write, every model invocation is written to an append-only audit log. Audit trails support customer compliance reviews, Federal Audit Office inquiries, and internal investigations without engineering intervention.

• Append-only audit log
• Per-object lineage
• Per-action attribution
• Tamper-evident chain

Software bill of materials published per release. No banned foreign components. No firmware from sanctioned jurisdictions. Customer-controlled signing keys for deployments.

• SBOM · per release
• Sanctions screening
• Customer-controlled keys
• No third-party telemetry