Every integration widens the surface.
Each new SaaS connection is another place where your source, your systems, and your customer records can be copied, retained, or compromised.
Your code called. It wants to come home.
Your code and context stay on machines you own. Every task is scoped before it runs, signed when it finishes, and receipted for anyone who needs to verify it. No model required. Our cloud is private and zero-trust — it runs without your data.
Built on
pap://
Principal Agent Protocol
Trust is not a checkbox.
We build the infrastructure that runs powerful technology without surrendering the code, context, and control that make your company yours.
We build for teams working with proprietary code, sensitive data, and real consequences. The goal is not more policy. It is an enforceable boundary — one that keeps every action scoped, local, and accountable.
Meet the pap:// stack →
01 / Ownership
Your machines. Your keys. Your rules.
02 / Proof
Every meaningful action leaves a receipt.
03 / Momentum
Control that helps teams move faster.
Convenience became the most expensive compromise.
Tools that promise acceleration often create a new kind of drag: hidden exposure, metered context, and a queue of generated code that has to be fixed before it can be trusted.
Helpful means handing it over.
An assistant that needs your repository, your documents, and your internal APIs is asking you to hand them to infrastructure you do not control.
Tokenization adds cost, not trust.
Shuffling sensitive context into tokens turns every useful answer into a meter running in someone else's cloud. The bill rises. Control does not.
Bad code is expensive code.
Teams burn hours reviewing, repairing, and reworking weak model output when the machine should be doing bounded, useful work instead.
The cost of sending code out.
These are not theoretical risks. They are documented incidents from teams that trusted external tools with code and data they could not afford to expose.
None of these were sophisticated attacks. All three were preventable by design. The common factor is the same: data was trusted to an external system nobody on the team controlled.
275M+
The Canvas LMS catastrophe
In May 2026, the ShinyHunters group breached Instructure's Canvas platform — the LMS used by 41% of all U.S. higher education institutions — stealing over 275 million records including student IDs, private messages, and course data across 9,000+ schools worldwide. Finals were cancelled. Class-action lawsuits followed immediately.
Source: Wikipedia / Fisher Phillips, May 20261,000s
The GitHub repository breach
In May 2026, attackers compromised a widely-used coding tool to infiltrate and steal data from thousands of GitHub's internal repositories. Proprietary source code, internal tooling, and trade secrets were exposed. The attack surface existed because the tool had standing access to the codebase.
Source: TechCrunch / CyberSecurity Dive, May 2026364+
Healthcare hacking incidents in 2025
As of October 2025, the U.S. Department of Health and Human Services had recorded 364 hacking incidents against healthcare organizations. PHI records, patient histories, and billing data — surrendered to platforms that were never designed to enforce cryptographic identity at the request layer.
Source: American Hospital Association, Oct 2025Every industry has specific risks.pap:// has specific answers.
Our team has worked directly inside these industries. We built pap://, Papillon, and Chrysalis around the compliance requirements, threat models, and operational constraints of each sector.
| Sector | The risk you are carrying | The pap:// answer |
|---|---|---|
| Education | Student records, private messages, and IDs concentrated in shared databases create large-surface breach exposure — as the 2026 Canvas incident demonstrated at scale. | Cryptographic SD-JWT selective disclosure ensures principals access only the exact data fields their mandate permits. No centralized PII aggregation. No ransom leverage. |
| Law / Legal | Uploading privileged case files, trade secrets, and client communications to external platforms destroys attorney-client privilege and creates catastrophic discovery liability. | Papillon's OS-level sandboxed execution means case data never leaves the secure boundary. Cryptographic receipts prove what was accessed and by whom. |
| Health Care | Automated billing and scheduling processes routinely access full patient records when they need only a single field — a HIPAA violation waiting to be audited. | Mandate-scoped permissions limit principal visibility to specific PHI properties. Immutable co-signed audit logs provide cryptographic HIPAA compliance proof on demand. |
| Military | Supply-chain compromises and air-gapped leaks occur when logistics or intelligence processes operate without cryptographic identity enforcement across fragmented networks. | Fully on-premises, air-gapped Chrysalis deployment. Every principal action produces a cryptographic receipt. CMMC and DoD architecture requirements met by design. |
| Private Sector | Corporate IP theft through compromised browser extensions and unmonitored automation scripts accessing internal wikis, codebases, and financial systems. | Seccomp and pledge-level OS sandbox constraints prevent compromised principals from spawning subprocesses, accessing the filesystem, or exfiltrating IP — even if fully compromised. |
| Government | FedRAMP and CMMC compliance failures when processes operate across shared agency databases with assumed identity and no immutable audit trail. | Multi-tenant zero-trust architecture with immutable, cryptographically signed audit trails for every delegation step. FedRAMP, CMMC, and DoD-ready by architecture. |
| Private Use | Identity theft, financial credential leaks, and exposure of behavioral and financial data on platforms outside your control. | Device-bound keypairs with ephemeral session DIDs per transaction. No central registry. No token economy. Data stays on your machine. |
3 minutes · Scored across 5 dimensions · Written report, no email required
Build inside the boundary.
Two apps you can open right now. The protocol and registry they run on.
pap://
Principal Agent Protocol
Define what a principal can see, do, and delegate — then prove it on every request.
Papillon
The canvas where work gets done
State an intent in the address bar and it routes to an agent, not a search engine. You see the scope before anything runs.
papillon.baursoftware.com
Open the canvas ↗
Opens in a new tab.
Imago
The model runs on your machine
The model downloads once and never leaves. No per-token bill, and it works with the network unplugged.
imago.baursoftware.com
Start in your browser ↗
Opens in a new tab.
Chrysalis
Where agents are found and work is signed
Resolves which agent can do a job and co-signs the result. Discovery is unranked, so no platform captures the list.
- Hosted
- We run the registry. Point your apps at our endpoint.
- Self-hosted
- Your hardware, under a signed agreement.
Point the apps at our registry, at your own, or at any registry you trust.
Not another portal. A perimeter you can prove.
A self-hosted registry that runs work on your servers.
Chrysalis discovers and executes services on machines you own — no vendor in the middle. Most work resolves without a model call. Every execution is co-signed and receipted. Single binary. Runs air-gapped.
- Single binary. Linux, macOS, Windows, Docker.
- Every execution produces a co-signed receipt.
- Services are discovered unranked. No platform capture.
- Runs air-gapped. No external dependencies on boot.
- Hosted
- We run the registry and you point your apps at it. Your work still executes on your own machines — the registry resolves and co-signs, it never receives your source.
- Self-hosted
- Run the single binary on your own hardware, air-gapped if you want. Requires a signed agreement; you hold the keys.
Stop sending your code to strangers.
Cursor, Copilot, and ChatGPT generate useful code, but they do it by transmitting your source files, internal APIs, and business logic to external servers you cannot control or audit. Chrysalis generates on your own infrastructure with no vendor in the loop.
| Capability | AI coding tools | Chrysalis |
|---|---|---|
| Code generation without sending source to external servers | Sends your source to vendor infrastructure for every completion | Runs fully on your machines — no data leaves the perimeter |
| Compliance-safe with NDA, trade secret, and legal constraints | External transmission may void NDAs and create discovery liability | Air-gap compatible by design — nothing transmitted, nothing exposed |
| Cannot be subpoenaed or compelled to surrender source | Vendor retains generated context and can be compelled by courts | Nothing to surrender — hosted or self-hosted, the registry holds registrations and receipts, never your source |
| Cryptographic audit trail of every generation event | No verifiable record of what was transmitted or generated | Every request produces a co-signed receipt — what ran, what was accessed |
This comparison covers code generation scenarios where data residency, IP ownership, and audit requirements apply — regulated industries, law, defense, health, and teams under NDA.
Gold certified, adversarially tested.
Both pap:// and Chrysalis passed Gold certification from Raknor AI.
RGC-2026-0004
pap:// Gold Certification
40 scenarios — 26 governance + 14 adversarial
RGC-2026-0005
Chrysalis Gold Certification
42 scenarios — 29 governance + 13 adversarial
Adversarial testing highlights
- Injected governance overrides in handshake data — pap:// treated them as literal strings, never executed
- Forged credentials and expired-token replays — all rejected automatically
- Attempts to escalate a delegated permission beyond what was granted — blocked
- CEO verbal override after DENIED action — pap:// ignored it completely
- Server-side request forgery via AWS, GCP, and Docker metadata endpoints — all three blocked
- Audit suppression requests — both systems logged the request and continued recording normally
Compliance proves the policy existed.pap:// enforces it at the request.
Vanta, Drata, and similar platforms automate SOC 2 and ISO 27001 evidence collection. That work has real value. But no compliance certificate stops a principal from reading data outside its mandate at runtime. It only proves a policy said it should not. pap:// enforces the boundary cryptographically before the request lands.
| Capability | Compliance automation(Vanta, Drata, Secureframe…) | pap:// + Baur Software |
|---|---|---|
| Proves policies were in place | Documents that policies existed | Cryptographic receipt per action, signed and immutable |
| Stops a principal from exceeding its permitted data scope | Cannot. Policy is advisory, not enforced at runtime | SD-JWT mandate scope rejected at the protocol layer before the data is touched |
| Limits damage when a principal is compromised | Logs what was taken after the fact | Mandate scope caps what is reachable even if the principal is fully compromised |
| Compliance data stays off vendor servers | Evidence lives on vendor infrastructure | Self-hosted on infrastructure you own and control |
| Built for delegation chains | Designed for human-operated systems, not principal-to-principal | Child scope cryptographically cannot exceed parent scope, ever |
| Vendor can be compelled to hand over your data | Yes. Evidence and configuration live on their servers | Impossible. pap:// is a protocol, not a platform. We hold no customer data. |
| Runs fully air-gapped | Requires cloud connectivity and vendor uploads | Full air-gap supported on every tier |
Both tools have a place. A SOC 2 report does not prevent a principal from reading a field it was never authorized to see. That gap is what pap:// closes.
Owned infrastructure without the overhead.
Tenure is for teams that want the stack on their own servers without a dedicated infrastructure team. Flat monthly rate. Your credentials. Your data.
Bring it home.
20 minutes. A straight answer on whether it fits.