Zero-Egress Design

GLACIS is designed so sensitive evidence never leaves your infrastructure.

The Problem

Traditional compliance solutions require sharing evidence with third parties:

• Audit logs sent to external services
• Request/response data stored externally
• Sensitive data exposure risk

The Solution

GLACIS uses cryptographic commitments:

┌─────────────────────────────────────────────────────────────┐
│  Your Infrastructure                                        │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Evidence (request, response, PII)                  │   │
│  │  STAYS HERE - never transmitted                     │   │
│  └─────────────────────────────────────────────────────┘   │
│                           │                                 │
│                           ▼ Commitment = sha256(evidence)   │
└───────────────────────────┼─────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│  GLACIS Services                                            │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Receives: Commitment hash only                     │   │
│  │  Cannot: Reverse hash to get evidence               │   │
│  │  Can: Verify proofs mathematically                  │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘

How It Works

1. Sidecar processes request/response in your infrastructure
2. Generates commitment (SHA-256 hash)
3. Sends only commitment to GLACIS
4. GLACIS validates and issues Merkle proof
5. Evidence stays local

Verification Without Access

Auditors can verify compliance without seeing evidence:

1. Request attestation and Merkle proof
2. Verify Ed25519 signature
3. Verify Merkle inclusion
4. Confirm commitment was issued

Tip

The commitment proves evidence existed without revealing what it contained.

Use Cases

• HIPAA: PHI never transmitted
• GDPR: Personal data stays local
• Financial: Transaction data protected
• Enterprise: Intellectual property safe

Kubernetes Enforcement

Use NetworkPolicy to enforce zero-egress:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: glacis-zero-egress
spec:
  podSelector:
    matchLabels:
      app: glacis-sidecar
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - port: 443

Next Steps

• Encryption
• Security Model