The trust posture below is the page Armasuisse, FINMA, and federal procurement teams come to first. Each item is a stated commitment, traceable to a control, a contract clause, or a Swiss law. Items marked as roadmap are dated.
Customer data never leaves Swiss jurisdiction. No CLOUD Act exposure. No FISA 702. No US-domiciled subprocessors. Where customer operations require it, deployments are entirely on customer premises with no outbound connectivity.
Founders, engineers, and Forward Deployed Engineers are Swiss citizens. Personensicherheitsprüfung (PSP) screening is conducted at the level the engagement requires — INTERN, VERTRAULICH, or GEHEIM. No subcontracting outside Switzerland.
Customer-managed on-prem, or Swiss-jurisdiction infrastructure. Never US hyperscalers for regulated workloads. Hosting partners are selected for Swiss legal domicile, Swiss operations, and Swiss-citizen access controls.
Native support for Swiss ISchV classifications. Markings propagate through the ontology — objects, properties, links, and actions all carry classification metadata. Purpose-based access controls enforce need-to-know.
The path to formal certification is dated. Where a target is open, Ithildin states it is open. We do not claim certifications we do not hold.
Ithildin runs inside fully disconnected Swiss bunkers. Updates are signed, packaged, and delivered over a one-way data diode by Ithildin Deploy. The bunker is never reachable from outside; the outside is never reachable from inside.
Every read, every write, every model invocation is logged immutably. Audit trails support customer compliance reviews, Federal Audit Office inquiries, and internal investigations without engineering intervention.
Software bill of materials published per release. No banned foreign components. No firmware from sanctioned jurisdictions. Customer-controlled signing keys for deployments.
Note · Ithildin uses no third-party cookies, no third-party analytics, and no embedded third-party trackers. There is no consent banner because there is nothing to consent to.
We can produce a full DPA, threat model, and ISchV mapping inside two working days. Briefings on request.