Stage
Profile.
Schema, cardinality, distributions and constraints are profiled in place, behind the data boundary. Nothing is copied out at this stage.
Modules
Four Modules. One Policy Surface.
The Counterpart Engine ships today. The other three are in build or pilot, and each module states its own state and boundary rather than borrowing the suite’s.
Module 01 — TransportIn build
Quantum-safe transport at the edge of every zone.
The PQC Gateway terminates and re-establishes traffic with hybrid classical and post-quantum key establishment, so traffic captured today does not become readable once a quantum-capable attacker exists.
- Hybrid by defaultX25519 and ML-KEM-768 are negotiated together, so a failed post-quantum half still leaves the session classically protected.
- Key custody stays putGeneration, rotation and revocation run against the customer KMS or HSM; the gateway holds no long-term private key of its own.
- Policy per zoneEach zone declares which suites are acceptable, which are recorded as legacy, and which are refused.
Interfaces
TLS 1.3 hybrid KEMmTLS · SPIFFEPKCS#11gRPC · HTTP proxy
Evidence produced
Negotiation records per session, a key rotation history, and a per-zone suite policy with the exceptions that were granted.
Boundary
The gateway protects transport only. It does not classify data, does not replace endpoint or identity controls, and cannot protect an exchange that should not have happened.
Module 02 — DataShipping product
Governed counterparts instead of production copies.
The Counterpart Engine reads schema and distributions behind the data boundary and produces relational and tabular counterparts, with utility measured separately for each task they are meant to support.
- The privacy model is declaredEach workload carries a defined privacy model, its parameters and its limitations, and all three travel with the release.
- Utility is measured per taskStructural fidelity, statistical fidelity and downstream performance are reported separately, because material fit for load testing is not automatically fit for model training.
- Referential integrity survivesKeys, cardinality and cross-table constraints are preserved, so applications behave as they do against production.
Interfaces
JDBC · ODBCCDC streamsParquet · CSVCI runners
Evidence produced
Methods, parameters, results and limitations per release, under a release identifier that stays inspectable afterwards.
Boundary
Current scope is relational and tabular data. Complete behavioural replication of an enterprise system is not a current product claim, and testing cannot prove the absence of every future attack.
Module 03 — GovernanceIn build
One place where governance is decided and recorded.
Policy Orchestration holds which privacy model, which approval and which retention period apply to a workload, and refuses releases that do not meet them.
- Policy as codeRules are versioned artefacts, reviewed like any other change, with the diff visible to whoever signs the release.
- Approval before releaseA counterpart or a transport change reaches production only once the named owner has accepted the evidence attached to it.
- Retention is an eventEvery release carries its retention horizon, and expiry is acted on rather than noted.
Interfaces
OpenAPIGit-backed policyOIDC · SCIMWebhooks
Evidence produced
A decision log with policy version, approver, timestamp and the evidence bundle that was accepted.
Boundary
Holds metadata and decisions only. No production records and no key material pass through it, and it cannot enforce a policy that was never written down.
Module 04 — IntegrationPilot
Connect the systems that are already running.
Adapters attach the suite to databases, message buses, key vaults, CI pipelines and analytics environments, so adoption does not begin with a migration project.
- Read-side adaptersSchema and distribution profiling against relational sources and change streams, without copying rows out of the zone.
- Key and identity adaptersKMS, HSM and workload identity providers, so cryptographic material stays where policy already places it.
- Delivery adaptersCounterparts and evidence land in the pipelines that consume them: CI, test environments, analytics and model training.
Interfaces
Postgres · Oracle · SQL ServerKafkaAWS KMS · Azure Key VaultGitHub · GitLab CI
Evidence produced
A connection inventory with scope, credentials model and the data classes each adapter is permitted to touch.
Boundary
Relational sources are in pilot scope first. Message-bus and telemetry adapters are design-partner work and are not contractable today.
Pipeline
From production boundary to accepted release.
Boundary
What stays inside.
Production rows stay in the source zone; only a statistical profile is retained.
Stage
Generate.
Counterparts are generated against the declared privacy model, preserving referential integrity across tables so applications behave as they do against production.
Boundary
What stays inside.
Generation runs inside the same zone as the source system.
Stage
Measure.
Structural fidelity, statistical fidelity and downstream task performance are measured separately, and limitations are written down where a counterpart is not fit for a purpose.
Boundary
What stays inside.
Measurement reads the counterpart and the profile, not the production records.
Stage
Release.
The accepted counterpart leaves with its evidence record: methods, parameters, results, limitations and a release identifier that stays inspectable.
Boundary
What stays inside.
Only the counterpart and its evidence record cross the boundary.
