KAELOX.

Architecture

The boundary is the product.

Kaelox ships as a signed container running as a sidecar beside the systems you already have. It reads in shadow mode. It writes nothing back. There is no code path to a control system.

Part one — inside the site ↓Part two — across jurisdictions

Part one — inside the site

Data flow inside a site: your systems feed a read-only tap into a signed sidecar container. Four named agents propose; a deterministic gate decides; a named person signs; every event is written to an append-only chain. Sandbo-X is isolated with no path back. Only bounded regulatory metadata and a SHA-256 digest cross the boundary.
Trace it with a finger. There is no path outward that is not labelled.Kaelox · topology as built

Part two — across jurisdictions

A unit crossing from Japan to the United States to Germany. A Trust Envelope is sealed at each crossing and evaluated against the destination jurisdiction. Only metadata and a SHA-256 digest cross. One software release is authorised in the United States and held in Europe.
Sealed at each crossing — evaluated against the floor of the country it is going to.Kaelox Trust Envelope · HLR-049
Where the boundary sits — you choose3 deployment modes
ModeFor
Air-gapped, on premisesFacilities that will not connect at all
HybridYour own data centres under a single control plane
Private cloud tenantWhere your estate already lives

Raw payloads never cross that boundary in any mode. What leaves is bounded regulatory metadata and a SHA-256 envelope digest. IEC 62443 targeting Security Level 2 — that assessment has not been performed by an external assessor, and we say so.