We're a self-hosted product with no sales team — so the container itself has to carry the trust argument. Everything below is a property you can check, not a promise you have to take.
No CONTENT ever leaves your network: no schema names, no rows, no SQL, no prompts, no question text — not in telemetry, not in error reports, not in license checks. Connected tiers send a published, versioned, closed-schema pod pulse of numbers and enums only (counts, version, license state) that you can read in the docs and verify on the wire with egress-audit. The air-gapped Sovereign tier sends nothing at all: license verification is pure local cryptography (Ed25519 against a key baked into the image).
The built-in `factrule egress-audit` command runs the pipeline while recording every network destination the process touches, then reports internal vs external endpoints. In the air-gapped posture it proves zero external connections — an attestation you can run in front of your own security team.
Posture A (bring your own key): prompts containing schema, question text, and small result previews go to YOUR OpenAI/Anthropic/Azure/Bedrock account. Posture B (in-network model via vLLM/Ollama): nothing leaves the network. Posture C (air-gapped): posture B plus baked embeddings and offline activation. Embeddings always compute locally in every posture.
The container refuses to start ungoverned, auto-generates its API bearer token on first boot, runs as a non-root user, loads no CDN assets, and ships with strict mode ON: a misconfigured model or embedder is a hard failure, never a silent degradation to fake components.
FactRule needs a read-only role. All probes are SELECT-only, statement-timeout-bounded, and row-capped; every query it runs against your database is logged locally. The verification layer is deterministic SQL — no model can widen its blast radius.
Everything FactRule learns — the knowledge graph, value dictionary, interpretation memory, audit chain — lives in plain, documented files on your volume. Back it up with a snapshot, inspect it with a text editor, export it without asking us.
Licenses fail open: an expired key keeps serving and pauses only new learning. Enterprise agreements include source escrow. If we disappear, your deployment does not.