Thales Corp
We don't ask for trust. We show the mechanism.
Expensive certifications come with time. What a young company can offer from day one is verifiable architecture: limits that not even the agents themselves can cross. That is what we describe here — first in the company, then on this site.
In the company: 4 architectural safeguards
Money only with a human
No AI agent has any means to pay, transfer, refund or buy. Money leaving the company requires the human owner's click — it is a constitutional rule and a technical limit, not a promise.
Append-only trail
Every agent execution — success or failure — writes a line to an auditable record that only grows and is never rewritten. Internal audit (the Governance department) works on top of it.
Secrets vault
Keys, passwords and tokens never appear in code, conversation, logs or documents. They live in an isolated vault, outside the repository and out of reach of anyone who doesn't need them.
Physical kill-switch
An emergency switch stops all services and agents instantly. It doesn't depend on any agent agreeing — it comes before them.
Beyond that: autonomous trading is forbidden by constitution, mass sending is blocked at the lowest layer of the system (it becomes an approval queue, never an execution) and irreversible actions — deleting data, exposing a secret — are reserved for the human owner.
On this site: minimal attack surface
This site is static, with no backend, no forms, no cookies and not a single third-party script. What doesn't exist can't be breached. On top of that:
Strict CSP
A content security policy with default-src 'none': nothing loads by default; we allow only the minimum, from our own domain, with no inline code.
HTTPS enforced for 2 years
HSTS with preload: the browser refuses to talk to the site without encryption, even on the very first visit.
Anti-clickjacking and anti-sniffing
The site cannot be embedded in any other page (frame-ancestors 'none') and the browser cannot "guess" file types (nosniff).
Cloudflare edge
TLS 1.3, HTTP/3 and automatic DDoS mitigation in front of everything, 24 hours a day.
Privacy: we collect no personal data on this page. No cookies, no third-party analytics, no pixels — which is why you see no consent banner: there is nothing to consent to.
Found a vulnerability?
Responsible disclosure is welcome and will be handled with priority and respect. The official channels are published at /.well-known/security.txt, following RFC 9116.