a WRAITH product
What we protect, how, and where the limits are.
This page is written for your security reviewers. It states what Candor AI guarantees, what it relies on, and what it does not do.
Cryptography
Post-quantum where it matters for long-lived evidence, standard primitives everywhere else.
| Purpose | Algorithm | Standard |
|---|---|---|
| Batch authorship (who wrote the records) | ML-DSA-65, domain-separated contexts | FIPS 204 |
| Content confidentiality (prompts, outputs) | X-Wing: ML-KEM-768 + X25519, HKDF-SHA256, AES-256-GCM | FIPS 203 hybrid |
| Record integrity and inclusion proofs | Merkle tree with keccak-256, leaf/node domain separation | RFC 9162 (CT v2) |
| Canonical record encoding | JSON Canonicalization Scheme | RFC 8785 |
| Transport | TLS 1.3, X25519MLKEM768 preferred (PQ-only mode available) | Hybrid PQ key exchange |
| Key files at rest | scrypt + AES-256-GCM | |
| Subject pseudonyms | HMAC-SHA256 with an org-held key | GDPR Art. 4(5) |
Key rotation needs a certificate signed by the previous ML-DSA key, so an attacker who steals the owner's classical (ECDSA) wallet key still cannot produce a rotation that verifiers accept.
Trust model
| Party | Trusted for | Not trusted for |
|---|---|---|
| Farnsworth | Selling licences (setting future prices and plans) | Holds no stream keys or roles and runs no servers in your data path. Cannot revoke or shorten paid time, change a plan's terms, or affect verification. |
| Your gateway host | Availability and honest capture while uncompromised | Cannot read past content (it holds only the archive public key) and cannot rewrite anchored history. |
| Anchorer wallet | Liveness | Anchoring alone is not authorship; batches also need the ML-DSA signature. |
| Your stream owner (Safe) | Publishing policies, rotating keys, choosing anchorers | A rotation verifiers accept needs the old PQ key's certificate. |
| Monad consensus | Ordering and timestamps of anchors | Authorship (ML-DSA) and integrity (hashes) do not depend on it. |
| Model providers | Processing under your contract with them | They see only post-DLP content; the policy pins their endpoints. |
Compliance packs
Each pack adds fail-closed checks to the policy. The gateway refuses to start on a configuration that contradicts a pack you enabled: for example a HIPAA policy routing to a provider without a BAA, PCI DSS without card redaction, or retention shorter than SEC 17a-4 requires.
Candor AI provides technical controls and evidence that support these frameworks. It is not itself certified, and using it does not make you compliant on its own. We provide a control mapping for your auditors on request.
| Area | Packs |
|---|---|
| Security management | SOC 2, ISO 27001, ISO 42001, NIST AI RMF |
| Privacy | GDPR, CCPA, HIPAA |
| Financial services | PCI DSS, GLBA, SEC 17a-4, FINRA 4511, DORA |
| Public sector | CMMC Level 2, FedRAMP Moderate |
| AI regulation | EU AI Act (record-keeping, transparency) |
Assurance
Before deployment, the contracts and the gateway went through repeated adversarial reviews by independent reviewers working as attackers. Every finding was reproduced with a proof-of-concept, fixed, and kept as a permanent regression test. Fixes were then reviewed again, because fixes introduce bugs too.
- Unit, fuzz and invariant tests on every contract
- Hostile-input tests on every parser and detector, including regular-expression denial of service
- End-to-end rehearsal on a Monad mainnet fork before deployment
These were internal reviews. An independent third-party audit is the next step; we will publish its report here.
Known limits
- Monad consensus and EVM transaction signatures (ECDSA) are not post-quantum. The design relies on them only for ordering; authorship rests on ML-DSA.
- DLP is pattern-based. Text a user deliberately encodes (for example base64) is opaque to it.
- Records are protected by the host's disk until their batch is anchored (seconds to minutes, depending on plan).
- Licence features are enforced by software you host; activation and anchor spacing are enforced on chain.
Contracts on Monad
Immutable: no proxy, no upgrade path, no pause. Verification never depends on the licence contract, so anchored evidence stays verifiable even after a subscription ends.
| Contract | Address (Monad mainnet, chain 143) | Role |
|---|---|---|
| CandorLedger | 0x4f61d1d660Aac70b76e6c5276e6eD9f6A1444059 | Anchors ML-DSA-signed Merkle roots per stream; on-chain inclusion proofs |
| CandorLicense | 0x4F412fbeE22F9784Fc68eACeAA9ef848C6dA387C | Subscriptions in USDC, paid directly to the treasury; activation for the ledger |
| CandorSpendGuard | Deployed per customer, owned by your Safe | Agent treasury with hard caps and kill switch |
Report a vulnerability
Email timowhite88@dagentx.com with the details and, if you can, a proof of concept. We acknowledge reports within two business days and will not pursue good-faith research that avoids privacy violations, data destruction and service disruption.
Documentation for reviewers
Licensed customers and prospects under NDA receive the architecture document, the full threat model, the control mapping and the complete internal audit reports.
Request the security review pack