Regulated environments
When code and data cannot leave your infrastructure, run the sandboxes yourself, keep a log you can check, and rely on policy decisions with machine-checked proofs.
On-prem for enterprise
On-prem deployments are available for enterprise: talk to us. Credentials stay on the host and never enter the sandbox.
Tamper-evident audit log
Every agent run, event, session and control action is appended to a hash-chained log, with policy refusals recorded alongside as policy.denied events.
Lean-checked policy models
The network profile, filesystem policy and remote-access decisions have proofs in Lean 4, tied to the Go code by generated test vectors the implementation must agree with. Examples: deny beats every allow, adding a deny never widens access, the network floor never opens. The proofs cover the decision models, not the kernel or the firewall itself.
What we don't claim
Semantic holds no compliance certifications. The controls above can support your own assessment; they do not replace it.