The private environment

The firm's own cloud account, the firm's keys, and a revocable Proxara role.

Updated August 2026

For IT and security owners. Connect runs in one environment dedicated to one firm: the firm's own AWS account or Azure subscription, keys the firm administers, and a Proxara role the firm can revoke.

The firm's AWS accountKMS · firm-held

VPC · 3 AZECS FargateRDS Multi-AZS3 Object LockRedisLocal model in-region

Prompt content stays inside this boundary.

Ops role · revocable

ProxaraOperates · never owns keys

The customer-owned mode: the firm's account, the firm's keys, a revocable Proxara role

Who controls what

A dedicated account is isolation: no other firm shares the network, the database, or the keys. Isolation is not ownership, so every control below is recorded by name.

Control	Recorded as
Account or subscription owner	The firm, or Proxara under contract
Root or tenant administration	Who holds it
Encryption keys	Who administers, who only holds use rights
The Proxara role	Its scope, and how the firm revokes it
Support access	What exists, who authorizes, where it is logged
Network paths	Every route in and out, and which planes have none
Model artifacts	Their origin, and how digests are verified
Exit	How to suspend, export, and have the system removed

Two modes: the firm's own account with a revocable Proxara deployment role, or an explicitly contracted isolated managed account carrying the same written facts. The product states which is active, and never infers ownership from isolation.

The four separations: what can reach what

Plane	What it may reach
Raw processing and customer-contained inference	The firm's own stores and local models. No external model, no default internet egress.
External model gateway	Approved model endpoints only. No raw store, no mapping, no credential.
Execution workers	Only what a bound action needs, never a search surface over the firm's context.
Proxara operations	Content-free health only. No client content, prompts, artifacts, credentials, or keys.

Each connected system is reachable only at the exact endpoints it requires.

The stack, in AWS or Azure

One composition, in the firm's chosen region: private network, control and Work APIs, Work and domain-cell workers, document ingress, the privacy compiler, customer-contained inference, the external model gateway, the private workspace, execution and reconciliation workers, encrypted stores and queues, secrets and keys, content-free monitoring, and customer ingress with SSO.

AWS is the reference implementation, and Azure follows the same logical contracts: parity, not a weaker variant.

What leaves the environment

Beyond the firm's own connected systems, two things leave: content-free operational telemetry to Proxara, and the release package to the firm's own approved model endpoint.

Environment telemetry

Telemetry Ledger

Every byte Proxara receives from this environment. Each frame is written here at send time, before it leaves, with its hash, its full payload, and whether Proxara acknowledged it. Nothing crosses that is not on this page.

1,204 frames, newest first · 1,203 acknowledged

L0just now3f2a9c1b4d7e…Recorded

L14 min agoa17c4e90f2b8…Acked

L222 min ago9d4f13c7ea56…Acked

L023 min ago5e8b0a2f6c14…Acked

recorded 2026-07-04 14:22:05 UTCsent 2026-07-04 14:22:06 UTCframe 48213sha256 3f2a9c1b4d7e8a05c6f1b2d3e4a5f6079b8c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5

{
  "contract_version": 1,
  "enclave_id": "acme-prod",
  "ts": "2026-07-04T14:22:05Z",
  "manifest_id": "px.2026.07.stable",
  "ring": "ring1",
  "services": [
    { "name": "api", "status": "up", "restarts": 0 },
    { "name": "classifier", "status": "up", "restarts": 0 },
    { "name": "shipper", "status": "up", "restarts": 1 }
  ],
  "steward": { "alive": true, "budget_pct": 82.4 },
  "agent_versions": { "1.11.6": 213, "1.11.5": 4 },
  "slo": { "protection_pct": 99.97, "api_avail_pct": 100.0, "slo_basis": "health_columns_only" },
  "cost": { "mtd_usd": 214.6, "bedrock_mtd_usd": 38.2 },
  "resources": { "cpu_pct": 22.5, "db_storage_pct": 41.0, "quota_flags": [] }
}

Open any row, read the bytes

Every frame that leaves is written down and readable in the console

The telemetry ledger, and the release package

Every field in a frame is a count, a version string, a percentile, or a category code, and no field exists that free text could travel in. Each frame is written to the Telemetry Ledger with its hash and its full payload, so the firm can open any row in the console and read the exact bytes.

No copy of the release package reaches Proxara.

Keys, models, releases, and the record

Encryption at rest runs under keys the firm administers. Proxara's use rights are revocable, and administration never leaves the firm.

Releases are signed, and models inside the environment do not update themselves. The firm can verify the model artifact and its digest, its license and source, the serving image, and the revision it rolls back to.

The record is signed at source, and an export carries the signed bytes, the signatures, and the public keys, so a reviewer checks it with their own tools.

Where to go next

To understand	Read
Every control, in one list	Security Overview
What a security team asks first	Connect security review
The processing terms	Data Processing Addendum