[§ 02] SOVEREIGNTY
Engineered in Norway. Hosted under Icelandic law.
Every byte of compute, every prompt chain, every container — sealed inside the EEA.
// Sovereign Shield
Engineered in Norway.
Hosted strictly under Icelandic jurisdiction.
Every byte of compute, every prompt chain, every container — sealed inside the EEA. Iceland's data-haven status, combined with EU-equivalent regulation, gives Enact a legal moat no US hyperscaler can replicate.
Immunity from FISA 702
Hosting under strict Icelandic law prevents foreign state agencies from demanding warrantless access or executing secret directives against your workloads.
GDPR Article 48 & NIS2 Compliance
Native alignment with European digital sovereignty laws. Drop-in ready for finance, healthcare, and regulated software supply chains.
BYOAK — Bring Your Own API Key
Plug in your own Mistral, DeepL, or any European model keys. We never markup tokens. You pay only for secure sandboxed runtime.
// Security Specifications
Crash-proof execution. Cryptographic approvals.
Every agent step is committed to an immutable ledger before it runs. Every privileged action waits for a hardware-signed user approval. No silent retries. No invisible side-effects.
01 — Durable Execution
Temporal-style ledger, soldered to SQLite.
Steps are atomically journaled before they execute. If the host process dies — kernel panic, OOM, power loss — the next worker resumes from the exact last committed step. Zero double-spends. Zero phantom writes.
- Write-Ahead Log fsync before exec
- Deterministic replay on restart
- SHA-256 chained, tamper-evident rows
Requests read access to
/repo/payments/stripe.ts
scope: read · 1 file · 32 lines
Touch sensor to approve
02 — WebAuthn HITL Approval
Touch ID. Face ID. YubiKey. No shared secrets.
When an agent requests filesystem, network, or secret access, the request is signed by your platform authenticator. The private key never leaves your device. A stolen session token cannot approve anything on its own.
- FIDO2 / WebAuthn level-2 attestation
- Per-action challenge, never replayable
- Hardware-bound private keys (Secure Enclave / TPM)
