Security & sovereignty
Air-gap-safe by construction, not by configuration
Cortessa is built to the constraints of a controlled environment: sovereign, offline-first and provenance-gated by design. It runs disconnected inside an accreditation boundary — the same bar defence sets, cleared for everyone else.
No external calls at runtime
In its default mode nothing leaves the machine to answer a question. There is no corpus upload, no query sent to a third party, no telemetry that phones home. Cortessa is a self-contained console: no web fonts, no CDNs, no external services — designed around the constraints of UK OFFICIAL environments. Classification and accreditation are determinations the deploying organisation makes about its own environment; what Cortessa contributes is an architecture built for that boundary, not a self-declared tier.
This site is built the same way. It has no third-party CDNs, no external web fonts and no analytics or trackers that phone home; every asset is self-hosted. It loads inside an accreditation boundary, disconnected — the same constraint the product is built to.
The model is on the box; the cloud is a switch you need never flip
The unit answers with a model already resident on it, inside your boundary. The off-box tier exists so that a site whose policy later permits a regional cloud option is not rebuilt to get one — it ships switched off and can be locked out permanently. The classification ribbon shows the active mode at all times.
- On-device (standard) the model and the whole ingestion pipeline are resident on the box and run full time; nothing leaves the machine.
- Retrieval only the floor beneath it — ranked source passages with their citations, no model in the loop. Always available; never a failure.
- In-region cloud — off by default a future option for a site whose policy later permits one. It ships switched off, and can be locked out entirely so it cannot be selected at all. Opt-in and logged if it is ever enabled (UK, London / eu-west-2).
Offline cryptographic licensing
Cortessa activates with offline cryptographic activation — no account, no phone-home. Licences are issued per seat or per site. A 30-day evaluation converts to activation without the machine ever needing to reach a licensing server on the internet.
The commercial model matches the security model: near-zero infrastructure to stand up, nothing to expose, nothing to leak. One file, activated cryptographically, on a dedicated workstation inside your boundary.
Auditability you can inspect
Because the product is a single self-contained executable with no external calls, its behaviour is inspectable within your boundary. The provenance gate is deterministic: the same input and policy version yield the same Verified / Draft / Refused decision, with the cited source retained for human inspection.
- Deterministic gate. Versioned containment rules are enforced in code, not left to a prompt.
- The off-box tier is off, and lockable. It ships disabled and hidden; an administrator must switch it on deliberately, and an allowlist can remove it permanently. If it is ever used it is logged, so the boundary crossing stays visible.
- Self-contained footprint. No server to harden, no CDN to trust, no tracker to review.
- The engineer signs off. Cortessa hands over cited evidence; it never certifies on your behalf.
In the 480-question blind evaluation, retrieval was ~97%, strict factual accuracy was 76.9% in the shipped configuration, and all 16 model fabrication attempts were held back by the gate. In a separate 60-question exam on a real physics corpus, 12 of 12 out-of-corpus questions were refused with 0 fabrications, fully offline. Both protocols were internally executed with blind separations; raw artifacts are hash-manifested.
Evaluate it inside your own boundary
A scoped, paid pilot runs on your hardware, behind your firewall, disconnected if you need it to be.