Platform · Security
One signed binary. No interpreter in the request path. Nothing leaves.
Security is a property of the request path, not a feature beside it. Metrale Engine is one binary of about 75 MB with no Python, no PyTorch and no runtime compilation. What runs is what was signed, and what it touches stays inside your perimeter.
Who this is forCISOs, security architects and compliance owners who have to approve an inference stack for regulated data, and the engineers who have to keep it approved.
In the console
The governance view. Policies, provenance for one response and the audit log.
Metrale Console. Demo data, recorded from the product mockup.
What it does
A request path you can read
HTTP to kernel dispatch in Rust. No Python environment to resolve, no two hundred transitive dependencies, no runtime download. Cargo deny audits every dependency on every pull request.
Signed artifacts, promoted by digest
Recipes, models and kernels arrive as signed artifacts. Kernel targets are content hashed down to their transitive include closure, so a build proves what it was compiled from.
Nothing leaves your perimeter
Prompts, weights, outputs and telemetry stay on hardware you own, in your cloud account, or on an air gapped network. Prompt and output logging is configurable and off by default in enterprise deployments.
Links designed for a hostile network
Node to node transport assumes every link is untrusted, so the mesh spans racks, sites and edges you already have with no private backbone and no VPN to babysit.
The control plane is out of band
It manages configuration, licensing, versions and aggregate telemetry. It is never on the synchronous inference path, and an outage never stops running workers.
Threat model on the page
CUDA kernel memory safety, API input validation, weight loading and unsafe FFI are the named review targets. The security policy says what is automated and what is human review, and claims nothing it does not run.
Python or PyTorch in the request path
the whole signed binary
acknowledgement window for a reported vulnerability
dual licensed, so legal knows exactly what it signed
Questions
The questions we actually get asked.
Short answers. Each one is backed by something on this site or in the repository.
Who owns the data?
You do. Prompts, weights, outputs and telemetry stay on hardware you own, in your cloud account, or on an air gapped network. The control plane manages configuration, licensing, versions and aggregate metrics, and it never sits on the request path. In a bring your own cloud deployment no inference request leaves your account.
Can it run air gapped?
Yes. The engine is one binary with no runtime download and no Python environment to resolve. Recipes, models and kernels are delivered as signed artifacts and installed from local media. Telemetry can stay entirely inside the network and export on your schedule, or never.
Does it run in my cloud account?
Yes. Bring your own cloud deploys the engine and router into your AWS, Azure or GCP account, on your GPU node pools, through Terraform or Helm. The control plane sees configuration, licensing, versions and aggregate telemetry, and nothing else. Regulated buyers can run the customer pull GitOps mode, where Metrale never holds credentials to your account.
What about SOC 2 and compliance?
The architecture is built for regulated buyers, and SOC 2 readiness documentation, model risk documentation and pinned recipe governance packs are part of the first SLA engagements. Ask for the current state of the audit program when you book. We will tell you exactly where it is.
Ask the rest in a working session, or read the deployment guide ↗.
Next step
See it against your own workload.
A side by side ladder on your hardware in week one. Your models, your criteria, your receipt.