# Arkheia — Security & Deployment Brief

*A take-away document for the technical evaluator answering "will it work in our environment, and
what does it do with our data?" Same facts and maturity labels as the diligence page at
https://synesis.arkheia.ai/site/diligence/.*

Maturity labels: **live** = public/testable today · **demo-grade** = working demonstration ·
**dogfood** = we run on it · **pilot** = with an evaluation customer · **roadmap** = stated direction.

Arkheia is a governed AI capability company; the governance is not a report you read afterwards, it is
**on the execution path**. A runtime detection verdict gates the invocation *before* a workflow uses
the answer. This brief covers where that path can sit in your stack and what it does with your data.

---

## Deployment patterns

These are **deployment patterns**, not shrink-wrapped SKUs. The public demo
(https://synesis.arkheia.ai/demo/) is the immediately testable surface; the patterns below are how
Arkheia sits in a real stack.

### (a) API proxy — **dogfood**

- Point your SDK **base URL** at the Arkheia proxy.
- Inference flows through and is **scored inline** at the invocation boundary.
- **Fail-open:** if detection is unavailable, inference still flows. Detection degrades; it never
  blocks your traffic.

### (b) MCP server — **dogfood**

- Arkheia exposes **detection / verification, memory, and audit** as **MCP tools** that an agent or
  IDE can call directly.

### (c) Local / self-hosted — **pilot**

- For sensitive customers, the **in-path detection component (proxy + detection)** and the **MCP tool
  server** can be **self-hosted on your own infrastructure**.
- Consequence: **prompts and data never cross a shared backend.**

### (d) On-prem — **roadmap**

- A fully on-premises deployment of the in-path components is offered as a deployment option for
  environments that require it.

---

## Data posture

| Question | Answer |
| --- | --- |
| Does it retain prompt/response content? | **Zero-retention by default.** The detection signal can run content-minimising, without retaining prompt or response content. |
| What leaves the environment? | In the **public demo**, prompts reach a **public Arkheia backend proxy**. In the **local / self-hosted** pattern, the in-path components run on **your** infrastructure, so prompts and data do **not** cross a shared backend. |
| What is the failure behaviour? | The **API proxy is fail-open** — a detection outage degrades the signal, it does not stop inference. |
| Which models are covered? | API models (OpenAI, Anthropic, Gemini, xAI & compatible), local / self-hosted models where deployment permits, and MCP / tool calls. Coverage of the *detection signal* additionally depends on per-model profiles (see below). |

---

## Coverage caveat (read this)

Detection coverage depends on **per-model behavioural profiles**. A model with **no profile** returns
an **evidence-limited LOW** — meaning *"couldn't assess,"* **not** a clean bill of health. This is
surfaced explicitly so a missing profile is never mistaken for a passing verdict.

---

## What governance can do with a verdict — **dogfood + live**

When the verdict warrants it, the execution gate — **on the execution path, before the workflow uses
the answer** — can:

- **allow** the invocation,
- **block** it,
- **require human approval**,
- **kill-switch** mid-flight,
- **rollback**,
- and emit a **tamper-evident decision receipt**, with **cost attribution** and **audit evidence**.

---

## Two different failure modes (read this)

These are deliberately opposite, and the distinction matters for a security review:

- **Inference fails open.** If the detection signal is unavailable, inference still flows. A detection
  outage degrades the signal; it does not take down your traffic.
- **Autonomy fails safe.** Agent *authority* is staged and earned (critique-only → private note →
  bounded → supervised → learning loop → full auto → workflow ownership). Autonomy is never granted up
  front, and when in doubt an agent stays at the lower-authority stage. Turning autonomy up is a
  controlled, governed decision with the detection signal and the gate on the path at every step — not
  a default and not a leap of faith.

---

## Security notes for the reviewer

- **No internal endpoints, tokens, or auth flows are published** — none are public. Proxy / MCP
  evaluation access is arranged per evaluation.
- The publicly reachable surfaces are the marketing site, the diligence pack, and the live `/demo/`
  (URLs below). A governed earthworks movement-control + docket↔invoice reconciliation walkthrough is
  available on request.
- The strongest data-isolation answer for a sensitive environment is the **local / self-hosted**
  pattern (c), where the in-path components run on your own infrastructure.

---

## Reachable today

- Home: https://synesis.arkheia.ai/site/
- Diligence pack: https://synesis.arkheia.ai/site/diligence/
- Live detection demo: https://synesis.arkheia.ai/demo/