the artifact what you keep

The page you hand the auditor.

“Can you prove isolation for last Tuesday?” Last Tuesday is a closed window. A closed window replays — by someone who does not trust us, from the files it came with.

Bring your auditor

generated, not written every claim links to a hashed artifact replays byte-identically

0100 a sample

What a scope looks like on paper.

the artifact

Segmentation evidence — scope: payments-prod

window 2026-08-06 → 2026-08-13 · tenant t-4417 · generated on your infrastructure
5 roles · 18 declared paths · 1 escalation · exporters sampled 1:1000, stamped

verified
Enforced policy equals declared intentEvery rule in force maps to a named, approved declaration. No orphans.pass
Policy scored against traffic it never sawHeld-back and adversarial sets, run before enforcement, gate red on seeded defect.pass
Rules retired conservatively3 unused rules proposed; counters present; reachability model shows removal safe.pass
Cross-tenant reachabilityNo configured path to any other tenant. None observed — stated as not observed, not as absent.pass
Sensitive flow awaiting a named humancardholder-db → reporting: proposed, not enforced. Queued since 08-11.escalated

every decision carries user · time · event
inputs sha256:9f2c…a41d · results sha256:1c77…e0b3 · replay: themis replay --scope payments-prod --window w-2026-08-13 · raw flows never left the site

Sample artifact, lab topology. Shape and fields are real; the numbers are not yours yet. Plus: the network truth map, every rule classified, and a limits section derived from the inputs — sampling per stream, every construct the parsers could not read, every device without counters.

0200 what a third party does with it

Check the hashes. Replay. Identical.

01

Check the hashes

Every frozen input and the results carry a digest. The pack's claims point at them.

02

Replay

One command recomputes the ledger from the frozen inputs, through the same code path the engine ran.

03

Identical — or not

One flipped byte is detected. That gate has been shown going red on purpose.

An evidence pack that cannot be regenerated on a different day is a screenshot, not evidence.

0300 who reads it

Different rules by market. One artifact.

FranceNIS2 · ReCyF · SecNumCloud · HDS— timestamped verification, per-rule justification, recorded human decisions, machine-checkable isolation proof.
EuropeDORA · NIS2— an evidence pack per scope or per tenant, on demand, covering the entity and the ICT providers it audits.
United StatesNIST SP 800-207 · SOC 2 · FedRAMP— continuously verified least privilege; design and operating effectiveness across the whole window, not a screenshot.
SectorPCI DSS · NERC CIP · HIPAA · IEC 62443 · CMMC— the same per-scope pack, read against each family's controls. Directional; validated with your own auditors.
WorldwideISO 27001— the change workflow itself: proposal, verification, named approval, event log.

The claim is never “we make you compliant.” It is: we generate the evidence your auditors keep asking for, continuously, on your infrastructure.

e000 End.DT6 deliver

Bring your auditor.

Thirty minutes, read-only. The first pack comes out of the first two weeks on your own estate — with the replay command.

Start the free network audit Or just email us
Start the free audit — read-only