Crawdad’s security posture is structural, not promised. Every claim on this page is enforced by the architecture itself — not by policy documents, not by vendor assurances.
Crawdad runs as a transparent proxy on each device. Raw content — prompts, responses, documents — is inspected and enforced locally. These aren’t features you enable. They’re properties of the architecture that you’d have to deliberately break to lose.
Raw content never leaves the device by default. Inspection, detection, and enforcement all happen on-machine. Metadata-only telemetry egresses by default; content does not. Telemetry depth is customer-governed.
Metadata-only telemetry by default. The fleet console sees detection counts and posture signals — never raw prompts or responses.
Fully functional with no outbound connectivity. Detection, enforcement, and audit logging all operate entirely offline.
Sits in the network path as a local proxy. Every request to an AI provider passes through the detection pipeline before reaching the network.
The full multi-layer detection pipeline runs locally. No content is sent to a remote classification service. Latency is local, privacy is structural.
The audit log is immutable by construction, not by policy. Each entry is cryptographically linked to its predecessor using a Merkle chain with Ed25519 signatures. Tampering breaks the chain — and is detectable by anyone with the public key.
Every inspected request, every detection, every policy decision is recorded in a Merkle-chained event trail. Each entry references the hash of its predecessor. Delete or modify an entry and the chain breaks — visibly, cryptographically, permanently.
Merkle + Ed25519Policy floors for critical protections — exfiltration detection, credential interception — are cryptographically signed by the central administrator. A local user cannot silently lower enforcement thresholds. The signature is checked on every evaluation.
Signed enforcementAnyone with the public key can verify the entire audit chain from genesis to head. No special tooling, no vendor dependency. The verification algorithm is documented and reproducible.
Public-key verifiableAndrewSispoidis/contemporary-agent-attacks →
CC BY 4.0 · 497 attacks · 1,172 benign negatives · 22 categories
Crawdad is designed to support compliance with the frameworks below. We do not claim certification — we publish the architecture, the controls, and the benchmark so your compliance team can evaluate the fit.
Controls map to Trust Services Criteria. Local-first data handling, immutable audit trails, signed enforcement floors, and zero-knowledge telemetry are designed to support SOC 2 requirements.
PHI never leaves the device by default. The local-first architecture and metadata-only telemetry model are designed to support organizations working toward HIPAA compliance — without requiring a Business Associate Agreement for content inspection. Protected health information is never included in telemetry.
Financial data stays on the institution’s own infrastructure. The zero-knowledge model and immutable audit logs are designed to support compliance with GLBA safeguards and SEC recordkeeping requirements.
Crawdad operates fully air-gapped with no outbound connectivity requirements. Designed to support government, defense, and critical infrastructure environments where data must remain within sovereign boundaries.
The detection pipeline, audit architecture, and enforcement model are designed to align with NIST AI Risk Management Framework practices for AI system governance and risk mitigation.
Crawdad’s product code is licensed under the Business Source License 1.1 (BSL 1.1). You can read every line of source. You can audit the detection pipeline, the proxy architecture, the audit-log implementation. BSL 1.1 is source-available — it is not an open-source license.
The benchmark corpus is a separate work, licensed under Creative Commons Attribution 4.0 (CC BY 4.0). Clone it, redistribute it, build on it. The two licenses cover different things.
| Work | License | You can |
|---|---|---|
| Crawdad product | BSL 1.1 | Read, audit, and inspect all source code. Use under license terms. Not open source — not freely redistributable. |
| Benchmark corpus | CC BY 4.0 | Clone, redistribute, and build upon the benchmark corpus with attribution. Run it against any tool. |
Read the source. Run the benchmark. Verify the audit chain. Talk to us about how Crawdad’s architecture maps to your security and compliance requirements.