The operator's inability to read tenant secrets is enforced by three independent layers and provable from the audit log — not asserted in a privacy statement. This is the security core of the system architecture.
The claimZero-knowledge by policy, not by promise. No single layer is load-bearing: policy, code and operations each independently prevent an operator read, and a signed attestation report proves the human-read list is empty.
Sepulchre — zero-knowledge by policy · Apache-2.0 architecture by Blake Medulan · for more information contact blake@3halves-labs.com