PurfectShield — Delivery Pipeline

Slide 8: You compile what you audited — source delivery, hermetic build, customer-compiled binary

Source → Build → Binary → Acceptance Customer compiles from audited source — no vendor attack surface Source Tree Complete Go source vendor/ included every file listed in manifest no hidden dependencies deliver Signed Manifest SHA-256 per file $ sha256sum -c manifest verify before anything runs cryptographically signed verify Hermetic Build On customer toolchain pinned Go toolchain vendored deps, no network customer's own build infra compile Customer Binary Customer-compiled ./shield serve the binary in production is one YOU compiled accept ✓ Evals Green Acceptance gate final payment due What PurfectShield Does NOT Have: 🔑 No Vendor Keys We hold zero customer secrets 🖥 No Vendor Servers We operate no service — SOC 2 N/A 📦 No Binaries Only source, you compile it 📡 No Telemetry Zero data leaves your network Procurement: SOC 2 is genuinely N/A — we process no customer data and operate no service. Instead: architecture letter + vulnerability disclosure policy + contractual patch SLA. Escrow: built-in (you have the source). Integrator access: zero customer secrets.

Source Delivery

  • Complete source tree delivered, not binaries
  • Every file listed in signed SHA-256 manifest
  • Verify manifest before anything runs
  • No hidden dependencies — vendored and pinned

Hermetic Build

  • Build on customer toolchain — your infra
  • Vendored dependencies, pinned Go version
  • No network access during build
  • Binary in production = one YOU compiled

Zero Vendor Surface

  • No keys held by Purfect Labs
  • No servers operated by Purfect Labs
  • No telemetry phoning home — ever
  • SOC 2 genuinely N/A: no customer data processed

Acceptance Gate

  • Eval suite runs green on YOUR build
  • In YOUR environment, on YOUR hardware
  • Final payment is due on green — contractual
  • Not a demo in our environment — real acceptance

PurfectShield • GTM-025/GTM-026 Hermetic Delivery Pipeline • Slide 8 • Source: collat/diagrams/delivery-pipeline.html