Your data stays in the building.
Ouroboros OS is built to run fully air-gapped. Identity, retrieval, models and the audit ledger all run inside the customer's building, on hardware the customer owns.
Six controls, one deployment.
Built to run fully air-gapped
Models are served locally: llama.cpp today, vLLM planned for DGX Spark-class hardware. The models make no cloud calls, and the whole stack is designed to run without an internet connection. Cloud connectors, such as Microsoft 365, connect only if an admin turns them on.
The identity you already run
Single sign-on through authentik. Users and departments stay in sync over SCIM, and a disabled account loses access within seconds. authentik is built to federate with Active Directory, LDAP or Entra; we have not yet tested that against a live customer directory.
Permissions in retrieval
Documents are filtered by permission before the model sees anything. Two employees asking the same question get answers from different documents.
The Harness Contract
Our versioned rulebook for every request: citations required, a fixed refusal sentence, prompt-injection screening, approval gates and signed receipts.
Signed receipts
Every answer is signed and written to a ledger. A receipt can be re-checked at any time: the answer text matches, the signature is valid, the ledger entry is found.
An audit ledger
Every answer, approval and admin change is recorded, so a compliance team can reconstruct who asked what, what was approved, and who changed which setting.
One governed path to every answer.
Every request passes through the same layers, in the same order, inside the customer's building.
- EmployeesChat, Assist and Admin, white-labelled, in Arabic and English.
- Identityauthentik single sign-on, built to federate with Active Directory, LDAP or Entra, with SCIM user sync.
- Harness ContractCitations required, the fixed refusal sentence, prompt-injection screening, approval gates and signed receipts.
- RetrievalPermission-filtered search over a Qdrant vector store with bge-m3 embeddings, with OCR for scanned documents. A knowledge graph is built alongside; it is not yet used in answers.
- AgentsMail, calendar and Jira connectors, tested on demo servers so far, with governed skills and memory.
- ModelsOpen models, including our own Sayqal models, served locally with llama.cpp (vLLM planned for the 128 GB box). No cloud API calls.
- HardwareDesigned for one 128 GB box (NVIDIA DGX Spark class) or a 96 GB RTX PRO 6000 workstation, or a GPU server for larger sites.
- Audit ledgerEvery answer, approval and admin change.
Designed around known attacks.
An assistant that reads company mail and documents can be steered by what it reads. These are the risks we design against.
Prompt injection
OWASP ranks it the top risk for LLM applications (LLM01:2026).
Sayqal Guard, our own classifier, checks for injected instructions in English and Arabic. On a blind test written before training, it caught 22–24 of 25 attacks per set, with 1–3 false alarms; Meta's stock Prompt Guard 2 caught 0–5. Every verdict is recorded in the audit ledger.
Excessive agency
OWASP recommends human approval for high-impact actions (LLM03:2026).
Assist stops before anything leaves the deployment and shows exactly what will be sent. Declining skips the step. Every decision goes into the audit log.
Exfiltration through a crafted email
EchoLeak (CVE-2025-32711): researchers showed one crafted email could make a widely used cloud assistant leak data, with no click from the user. It was fixed in June 2025 (arXiv 2509.10540).
Sayqal Guard checks what the agent reads for injected instructions, and nothing leaves without a person approving exactly what will be sent. The models run inside the building, and an air-gapped deployment has no outside address to leak to.
Over-broad access
92% of organisations that reported an AI-related breach lacked proper AI access controls (IBM, Cost of a Data Breach 2026).
Permissions come from the customer's identity system (single sign-on through authentik, built to connect to their directory) and are enforced in retrieval, before the model sees anything. Learned skills and memories are scoped by the same permissions, and memories stay private to each employee.
Bring your security team.
We'll show them the receipts: identity, retrieval permissions, approval gates and receipt verification, in a live walkthrough of the demo company.