For the people who have to sign off on it.
A plain-English technical brief for IT managers, security officers, FSOs, and compliance leads: where data goes, what controls exist, and what stays your responsibility.
Our compliance statement, without the marketing.
No product makes an organization ITAR, CMMC, HIPAA, or GLBA compliant, and you should be skeptical of any vendor who says otherwise. Enclave is designed to support your program: AI inference runs on hardware inside your boundary with no required external connections, and the system provides access control, MFA, audit logging, and documentation you can use in your System Security Plan. How you configure, operate, and document it remains your responsibility.
Prompts go down the hall, not across the internet.
- Browsers and the optional Windows agent send prompts and selected file content to the Enclave server on your network.
- Models, embeddings, knowledge bases, chats, and audit logs live on that server, on encrypted storage.
- No telemetry or “phone home.” Enclave Servers has no remote access unless you grant it for a supervised session.
- Optional cloud model connections exist but are off by default. If an administrator enables one, data sent to it leaves your boundary, so keep them off for controlled data.
Controls that map to NIST SP 800-171.
Requirement numbers below use Rev. 2, the revision referenced by CMMC Level 2 and DFARS 252.204-7012. Our SSP materials also cross-reference Rev. 3.
| Control | How Enclave supports it | 800-171 Rev. 2 |
|---|---|---|
| Role-based access | Admin, user, and pending roles; group-based access to models, knowledge bases, and features | 3.1.1, 3.1.2, 3.1.5 |
| Unsuccessful logon limits | Configurable account lockout threshold and duration | 3.1.8 |
| Security notice | Configurable login banner and Acceptable Use Policy acknowledgment on first login | 3.1.9 |
| Session lock & termination | Inactivity timeout with automatic sign-off | 3.1.10, 3.1.11 |
| Audit logging | User and administrator activity logs, chat review per your policy, keyword flagging, exportable records | 3.3.1, 3.3.2 |
| Multi-factor authentication | TOTP MFA with admin-enforced enrollment | 3.5.3 |
| Password policy | Complexity, minimum length, reuse prevention; PBKDF2-SHA256 hashing | 3.5.7, 3.5.8, 3.5.10 |
| Directory integration | LDAP / Active Directory so accounts follow your joiner-mover-leaver process | 3.5.1, 3.5.2 |
| Media sanitization | Drives sanitized on-site per NIST SP 800-88 on return or de-installation | 3.8.3 |
| Encryption at rest | LUKS2 full-disk encryption on server storage | 3.13.16 |
| Controlled updates | Signed, checksum-verified packages with automatic rollback on failure | 3.4.1, 3.14.1 |
Mappings show where Enclave can contribute to a requirement. Whether a requirement is met depends on your configuration, policies, and the rest of your environment.
Boring, standard parts. On purpose.
Nothing exotic for your team to learn or your assessor to research.
- OSUbuntu Server 24.04 LTS
- RuntimeDocker containers
- InferencevLLM on NVIDIA RTX PRO Blackwell GPUs
- InterfaceHardened Open WebUI-based web app
- DatabasePostgreSQL
- StorageNVMe RAID, LUKS2 encryption
- AuthLDAP / AD, local accounts, TOTP MFA
- NetworkStatic IP on your LAN; no inbound internet required
Updates without opening a port.
We build a signed package
Each release is signed and checksummed.
You transfer it on USB
Download on a non-sensitive workstation and move it through your normal media-transfer process.
One command applies it
The script verifies the signature, applies the update, restarts services, and rolls back automatically if anything fails.
Paperwork your reviewers will want.
Available to prospective customers under a mutual NDA.
System Security Plan template
Pre-filled SSP materials describing how the appliance fits your boundary, with Rev. 2 and Rev. 3 references.
Architecture & network guide
System architecture, ports, and network configuration for your firewall and segmentation review.
Admin guide & runbooks
Administrator guide, integration checklists, and the update runbook, so your team never depends on us.
Bring your hardest questions.
Book a technical deep-dive with your IT lead or FSO. We’ll walk through the architecture, data flow, and SSP materials, and you can inspect the system yourself.