AegisTrustsec VPC-native complianceVPC 原生合规
Open console进入控制台

AegisTrust sec · VPC-native compliance AegisTrust sec · VPC 原生合规

Data stays in your VPC.
Every verdict is independently verifiable. 数据留在您的 VPC，
结论事后可独立验证

Unprivileged Agent scans cloud, IaC and AI runtime inside your VPC. Only a four-tuple verdict leaves — never your payload. Every result lands in an Ed25519-signed append-only ledger. 零特权 Agent 本地扫描云配置、IaC 与 AI 运行时。只上传四元组结论，绝不上传载荷。每条结果写入 Ed25519 签名的追加式账本。

Open console进入控制台 See the proof path查看证明链路
  • Egress出网数据 Four-tuple only仅四元组
  • AI runtimeAI 运行时 Circuit breaker执行前熔断
  • Ledger账本 Signed export签名导出

Proof path证明链路

Two control points. One verifiable trail.两个控制点，一条可验证的链路。

The two claims that matter to a security reviewer are enforced in code, not in a slide. 安全评审真正关心的两条主张，落实在代码里，而不是幻灯片里。

01

AI runtime shieldAI 运行时熔断

shipped已上线

The block lands between “the model decided” and “the tool ran”. That is the only point where a block can prevent the action. 拦截落在「模型已决定」与「工具真的执行」之间——只有这个位置能真正阻止动作。

  1. Discover发现Audited tool calls reveal the agent’s real surface.从审计过的工具调用还原 Agent 的真实工具面。
  2. Map映射Known tools are classified; unknown MCP tools stay unclassified rather than guessed.已知工具精确分类；未知 MCP 工具保持未分类，绝不猜测。
  3. Block熔断A SHIELD rule hit returns a reject and writes a rule id into the audit trail.命中 SHIELD 规则即拒绝执行，并把规则 id 写进审计轨迹。
02

Ed25519 ledgerEd25519 账本

shipped已上线

An auditor does not have to trust our database, our operators, or our company. They verify a public key. 审计师不需要信任我们的数据库、运维或公司，只需要验证一把公开公钥。

  1. Hash chain哈希链Each entry commits to the previous entry’s hash.每条记录提交前一条记录的哈希。
  2. Merkle root默克尔根A single Merkle root commits to the whole audit window.一个默克尔根承诺整个审计窗口。
  3. Offline verify离线验证The signed .zip ships with an open verifier and per-file SHA-256.签名 .zip 附带开源验证器与逐文件 SHA-256。
  1. 01

    Scan locally本地扫描

    Cloud, IaC, secrets and AI tool calls are inspected inside your VPC by an unprivileged container.云配置、IaC、密钥与 AI 工具调用由无特权容器在您的 VPC 内检查。

  2. 02

    Seal the verdict封存结论

    Only rule_id, status, detail and resource_hash leave. The ledger hash-chains every verdict it receives.只有 rule_id、status、detail、resource_hash 出网；账本对收到的每条结论做哈希链式封存。

  3. 03

    Export & publish导出与公开

    Download a signed evidence bundle, then publish a Live Trust badge that anyone can check.下载签名证据包，再发布任何人都能核验的 Live Trust 徽章。

Frameworks合规框架

Depth where an auditor actually looks.在审计师真正查看的地方做深。

AegisTrust is not the certifying body. Framework packs organise your evidence at control level; your auditor still signs the opinion. AegisTrust 不是认证机构。框架包把证据按控制项组织起来；最终意见仍由您的审计师签署。

SOC 2 AICPA · 2017

Trust Services Criteria信任服务准则

11 seeded controls including CC6.1, CC6.3, CC6.7, CC7.2 and CC8.1. Evidence is attached at the control level, with ISO 27001 and NIST cross-references carried alongside.内置 11 个控制项，含 CC6.1、CC6.3、CC6.7、CC7.2、CC8.1。证据按控制项归档，并同时携带 ISO 27001 与 NIST 交叉引用。

  • Collect: access-control policy, MFA proof, TLS configuration, monitoring samples.采集：访问控制策略、MFA 证明、TLS 配置、监控样本。
  • Fix: deterministic remediation for public storage, weak IAM and exposed ports.修复：针对公开存储、弱 IAM 与暴露端口的确定性修复脚本。
PCI DSS 4.0 PCI SSC

Cardholder data controls持卡人数据控制

Five seeded requirements: Req 3.4, 4.2, 7.2, 10.2 and 11.3. Encryption at rest, encryption in transit, least-privilege access, audit trails and continuous vulnerability scanning.内置 5 项要求：Req 3.4、4.2、7.2、10.2、11.3。覆盖静态加密、传输加密、最小权限、审计轨迹与持续漏洞扫描。

  • Collect: bucket encryption state, TLS policy, IAM scope, audit-log continuity.采集：存储桶加密状态、TLS 策略、IAM 范围、审计日志连续性。
  • Fix: S3 encryption and public-access blocks, security-group SSH lockdown.修复：S3 加密与公开访问阻断、安全组 SSH 锁定。
AI governance AI-TDG · MSA · AI-IP

Model, tool and data boundaries模型、工具与数据边界

Three AI packs aligned to EU AI Act Art.10–13, NIST AI RMF and OWASP LLM Top-10. Model provenance, prompt-injection defence, tool-call sandboxing and inference-data residency.三套 AI 框架包，对齐 EU AI Act Art.10–13、NIST AI RMF 与 OWASP LLM Top-10。覆盖模型来源、提示词注入防护、工具调用沙箱与推理数据驻留。

  • Collect: model source hash, tool inventory, permission mapping, blocked-action records.采集：模型来源哈希、工具清单、权限映射、被拦截动作记录。
  • Fix: tool-call sandbox rules, key-hygiene patches, RAG ingestion guards.修复：工具调用沙箱规则、密钥卫生补丁、RAG 摄入防护。

How evidence is collected证据如何采集

Uploaded evidence keeps its file hash; control status is computed from real rows; the export is a signed .zip with an offline verifier.上传证据保留文件哈希；控制项状态由真实数据行计算；导出为带离线验证器的签名 .zip。

How fixes are proposed修复建议如何给出

Where a deterministic fix exists, it ships as a patch plus a matching validation test. PR review is comment-only; AegisTrust never merges.存在确定性修复时，以补丁加配套验证测试交付。PR 审查只评论，AegisTrust 绝不替您合并。

Capabilities能力清单

What is actually running today.今天真正在运行的部分。

Status reflects the current build, not a roadmap. Everything listed is deployed. 状态以当前构建为准，不是路线图。下列能力均已上线。

  1. 01

    Zero Trust Agent零信任 Agent

    shipped已上线

    node:24-alpine, non-root, read-only root filesystem. Application-layer HTTP forward proxy, OTLP export and an offline NDJSON queue.node:24-alpine、非 root、只读根文件系统。应用层 HTTP 正向代理、OTLP 导出与离线 NDJSON 队列。

  2. 02

    WASM module sandboxWASM 模块沙箱

    shipped已上线

    Three zero-import modules (44 patterns total) with SHA-256 and Ed25519 checks before every instantiation. Unentitled modules transfer zero bytes.三个零 import 模块（共 44 条模式），每次实例化前校验 SHA-256 与 Ed25519；未订阅模块不传输任何字节。

  3. 03

    AI runtime shieldAI 运行时熔断

    shipped已上线

    Blocks a tool call between the model deciding and the tool running. Rule ids are written into the audit trail.在「模型已决定」与「工具真的执行」之间拦截，并把规则 id 写进审计轨迹。

  4. 04

    Fix Arsenal

    shipped已上线

    24 deterministic remediation scripts with 24 matching validation tests, precise Markdown patches and read-only PR review comments.24 个确定性修复脚本与 24 个配套验证测试、精确 Markdown 补丁，以及只读 PR 评论。

  5. 05

    Auditor portal审计门户

    shipped已上线

    A read-only view with one-click chain verification and a downloadable signed .zip that includes an offline verifier.只读大盘，一键校验签名链，并可下载带离线验证器的签名 .zip 证据包。

  6. 06

    Federated threat hashing联邦威胁哈希

    shipped已上线

    A block on one node contributes a one-way SHA-256 feature and a threat label. Plaintext never leaves the tenant.某节点的一次拦截以单向 SHA-256 特征与威胁标签进入共享情报库，明文永不出租户。

  7. 07

    Live Trust badgeLive Trust 徽章

    shipped已上线

    A public SVG badge served from a verifiable endpoint; when there is no data it renders grey instead of inventing a status.由可验证端点直出的公开 SVG 徽章；无数据时渲染灰态，绝不编造状态。

Boundaries可信边界

We say no on purpose.有些事我们刻意不做。

Every claim a security buyer has to defend in review is listed here — including the ones that would have been easy to fake. 这里是安全买方要写进架构评审的每一条主张——也包括那些本最容易注水、但我们拒绝注水的部分。

  • No eBPF, no kernel intrusion不做 eBPF，不侵入内核

    Kernel capture sees TLS ciphertext; plaintext needs privilege or TLS termination. We take the application layer instead. The forward proxy inspects only traffic explicitly routed to it — arbitrary HTTPS is never decrypted and we never install a CA.内核态抓到的只有 TLS 密文；要看明文就得挂特权探针或终结 TLS。我们因此选择应用层：正向代理只检查显式接入的流量，绝不解密任意 HTTPS，也绝不安装根证书。

  • No zero-knowledge proof theatre不做零知识证明的包装

    Ed25519 signatures over the chain head and Merkle root give an auditor the same practical guarantee — checkable with a public key.Ed25519 对链头与默克尔根签名，给到审计师同等实用的保证，而且拿一把公钥就能验。

  • No code write access不申请代码写权限

    Read and comment only. Patches are proposals a human applies; the decision stays with you.只读与评论。补丁是需要人工应用的提案，最终决定权始终在您那边。

  • No fake checkout不做假收银台

    Until a real payment channel is live, plans and modules are requested in the console, reviewed and provisioned manually. No card is collected on this site.在真实收款通道上线前，套餐与模块通过控制台提交申请、人工审核后开通。本站不收集任何银行卡信息。

Where this fits适用场景

Built for teams that cannot ship data to a SaaS.为不能把数据交给 SaaS 的团队而建。

Start with a read-only local scan. If the gap report is material, we scope a paid pilot with your security team. 先做一次只读本地扫描。如果缺口报告足够关键，再与您的安全团队一起界定付费试点范围。

Financial services金融服务

PCI DSS 4.0 evidence, audit trails and change control without exporting cardholder-adjacent data.在不导出持卡人相关数据的前提下，完成 PCI DSS 4.0 证据、审计轨迹与变更控制。

Healthcare医疗健康

Evidence stays at control level inside your environment; only verdicts are sealed in the ledger.证据以控制项为单位留在您的环境内，只有结论进入签名账本。

EU operators欧盟运营方

Data residency and GDPR-oriented controls, with an export an auditor can verify offline.面向数据驻留与 GDPR 的控制项，导出物可由审计师离线验证。

Public sector公共部门

No inbound access to your VPC, no code write permission and no kernel privilege required.无需入站访问您的 VPC，不申请代码写权限，也不需要内核特权。

Run the scan. Keep the data.跑完扫描，数据仍留在您手里。

Generate a single-line unprivileged Docker command, or start with the console. Nothing is installed until you decide it should be. 生成一条零特权 Docker 启动命令，或直接从控制台开始。在您决定之前，不会安装任何东西。

Open console进入控制台 Trust Center信任中心