Local Origin
Observe an authorized origin through an explicit loopback or private transport while preserving its public canonical identity.
KFIF ENTERPRISE Sentinel · v5.1.0 GA
Local-first security assurance.
Passive by design.
Evidence you can verify.
KFIF Enterprise observes authorized systems without exploiting them. It preserves forensic evidence, keeps observation perspectives distinct and gives operators control over data movement.
● Read-only● Local-first● KFIF 1.0● Zero implicit telemetry
WHY KFIF ENTERPRISE
Security work should leave an evidence trail.
KFIF Enterprise is a Python-based, single-node security assurance platform for authorized web systems. Its built-in plugins observe passively. They do not exploit vulnerabilities or change the target.
Each result records target identity, observation perspective, evidence lineage, integrity metadata and authorization context.
HOW IT WORKS
Authorize first. Observe second. Preserve the evidence.
- 01DefineTarget, perspective, transport, profile and plugins
- 02SimulateCheck policy and capabilities without target traffic
- 03ConfirmOne-time approval bound to the request
- 04ObserveAn authorized worker runs passive plugins
- 05PreserveEvidence, reports and KFIF
KFIF PLUGIN PLATFORM
Extend KFIF without weakening the core.
Build signed, permission-bounded integrations behind a frozen contract, verified package boundary and isolated process runtime.
Explore the Plugin Platform →PANTAW · LINUX NODE OPERATIONS
Passive awareness for the Linux node.
PANTAW v0.0.2 provides 17 deterministic, read-only Linux collectors, structured observations and dual audit backends. Debian 13 is validated; the release remains alpha/development.
Explore PANTAW →THREE PERSPECTIVES
Know where each observation came from.
Public Edge
Observe an explicitly authorized public endpoint, including behavior visible at the reachable edge.
Remote Authorized
Use the optional owner-managed authorization channel for controlled remote observation.
Local Origin does not describe CDN, WAF, public TLS, public DNS or other edge behavior unless those controls were observed separately. Correlation keeps unlike observations distinct.
WEB OPERATIONS CONSOLE
One authenticated workspace for operators.
Server-side sessions, RBAC, CSRF controls, queue status, policy simulation, evidence review and assurance checks are available in one local administrative surface.
How console access works →EVIDENCE & KFIF
Reports that keep their context.
JSON, HTML, Markdown and KFIF artifacts preserve evidence, provenance, perspective and integrity metadata. KFIF verification detects content changes. Authenticity also requires a valid detached signature and a trusted key.
Explore KFIF 1.0 →ENTERPRISE ASSURANCE
Machine-tested controls with clear limits.
Assurance Doctor checks privacy defaults, broker enforcement, capabilities, egress policy, signing trust, storage and backend state. PASS describes the current machine-tested state. It is not a certification or penetration-test result.
Understand PASS and WARN →PRIVACY BY DEFAULT
Zero implicit telemetry.
Analytics, crash upload, cloud sync, automatic report upload, silent OTEL transmission and update telemetry are disabled by default.
Read the privacy model →AUTHORIZED ENVIRONMENTS
Built for owners and operators.
For webmasters, self-hosters, DevOps teams, security engineers, internal IT, auditors and authorized researchers.
Review security boundaries →CURRENT RELEASE
Sentinel · v5.1.0 GA
General Availability · Signed and independently verifiable. v5.1.0 GA was approved and released on 12 August 2026.
Release and verification →TALK TO KFIF ENTERPRISE
Commercial licensing, partnerships or security disclosure.
Tell us what you need. The public site provides only entitlement-gated evaluation delivery and never exposes administrative systems or a permanent archive URL.
Choose a contact pathSTART WITH THE OPERATING MODEL