Because verification needs no platform, constrained deployments are tractable.
The entire cryptographic and verification core is pure TypeScript with zero platform dependencies — it runs unmodified on any modern JavaScript runtime today. That is the load-bearing enabler for everything below, and for sovereign, defence, and residency-constrained buyers.
Managed SaaS
Cloudflare's global edge; the live deployment. Zero customer infrastructure. Data residency via Cloudflare regional services and the Data Localization Suite.
Dedicated single-tenant
The same code in an isolated Cloudflare account and zone per customer — separate keys, separate BYOK, separate buckets. Tenant-level isolation and residency, still edge-hosted.
On-premise
Runs on workerd — Cloudflare's open-source Workers runtime — with emulated state, or a Node port; storage on any S3-compatible object store plus SQLite/Postgres. The scoring math is pure and runs anywhere; anomaly embeddings use a local model.
Air-gapped
Issuance in a local enclave with local key custody or an HSM. Verification needs only the published artifacts and the verifier binaries — zero network, zero platform dependency. Bitcoin/OTS anchoring is inherently online, so air-gapped certificates are valid on their signatures + local timestamp immediately, and the anchor attaches on next sync.
Multi-cloud portability
What's Cloudflare-specific is the stateful runtime layer — the per-entity ledger (Durable Objects), object storage (R2), and the embedding model (Workers AI). Each has a documented adapter path to standard alternatives (Postgres/FoundationDB, S3/MinIO, a local ONNX model). A multi-cloud or on-prem port is a documented engineering effort, not a drop-in — but the verifiers, the signatures, the Merkle and canonicalisation constructions, and the offline evidence bundles are already portable, and those are precisely what an outside party or a court actually needs.
EU data residency, day one
Data residency is available from the start via Cloudflare regional services, the Data Localization Suite, jurisdiction-pinned Durable Object placement, and EU-only storage. This matters for three distinct buyers: sovereign and defence customers who cannot use a US-headquartered cloud, financial institutions with data-residency mandates, and any acquirer assessing platform lock-in risk.
Determinism note: on untrusted physical hardware (an on-prem or air-gapped host in a hostile facility), post-quantum signing can switch to hedged mode per-deployment behind a flag — without changing the wire format or invalidating any verifier.
What runs today vs. what is a scoped deploy step. Core sealing, anchoring, and verification run in production today. A short list of commercial-hardening items — managed-KMS key custody, billing, SSO gating, and single-tenant throughput beyond current levels — are scoped deploy steps, not open research. Detail available under briefing.
The consequence stated plainly
Verification is unaffected in every mode. A certificate or sealed ledger verifies offline, forever, with the published MIT tools — whether it was issued on the global edge or inside an air-gapped enclave. Run the verifier yourself →