Tartarus Cloud
Sovereign Gateway
Security-hardened inference gateway
What it is
Tartarus Cloud is a private inference gateway operated entirely on hardware you own. It runs a four-engine rig - CPU, integrated GPU, discrete GPU, and a dedicated NPU, roughly 300 TOPS of nameplate compute - and routes each request between its local serving engines according to a live risk score that recalibrates against a target error rate as traffic arrives. Serving is bound to loopback: every internal hop is 127.0.0.1, and nothing is published to the internet unless the operator deliberately starts a tunnel. Escalation to a third-party model is an administrator-owned switch, and disabling it produces an explicit refusal rather than a quiet fallback - a compliance officer can prove the switch did what it said. Hostile prompts are identified and refused before a single token reaches a model, and personal identifiers are replaced in the model's output as it streams. Every installation mints its own credentials on first run: there is no shipped default to find, and none to fall back to. When a capability is not armed on a given machine, the console says so in plain words instead of showing a green light.
What is built, and what is ahead
Proven at the bytes: the loopback-only serving path, origin-locked access, risk-scored adaptive routing, prompt-injection refusal, streaming redaction, the local object store, per-install credentials, and the shipped installers. Stated rather than implied. ~300 TOPS is installed silicon on a specification sheet, not a benchmark. Attestation records but does not gate admission. Cloud escalation ships armed permissive, so absolute data residency is a configuration you close, not a default you inherit.
The numbers behind it
What it does
Risk-Aware Dispatch
Every prompt is scored before it is routed: the fast local engine for routine work, the escalation engine when the score crosses the live threshold. The threshold tunes itself against a target error rate as traffic arrives, and every decision is recorded with the threshold that produced it.
Refusal, Not Silent Reroute
Cloud escalation is an admin switch. Turning it off produces an explicit refusal rather than a quiet local fallback - which is what makes the switch provable to an auditor rather than merely present.
Hostile Prompts Stopped at the Door
Injection attempts are identified and refused before a single token reaches a model, and the refusal is written into the audit ledger with its category.
Streaming Output Redaction
Personal identifiers are replaced in the model's output as it streams, without breaking the stream and without losing the ability to reconcile them internally.
Attestation That Tells On Itself
The gateway can quote the machine's boot measurements on demand and bind the digest into its tamper-evident ledger. When no hardware root of trust is present, the console says 'software fallback' in plain words rather than claiming a root it does not have.
No Shipped Secrets
Every installation mints its own keys on first run. There is no built-in constant to find and none to fall back to - the two world-known defaults this product once carried were removed and named in the source so the lesson travels with the code.
A Store Built for the Actual Drive
The local object store is engineered against the measured behaviour of the volume it lives on: small objects are packed instead of wasted, integrity is content-addressed rather than timestamp-trusted, and every write checks the volume is still the volume before it commits.
It Survives Its Own Death
If the gateway stops answering, something outside the process notices and brings it back - and the console never reports healthy against a process that has gone.
Who it serves
It replaces a monthly inference subscription that also hands your prompts to somebody else's servers.
The model endpoints the gateway serves are on the machine in front of you, and files persist to a drive attached to that same machine rather than to a metered storage bill.
It removes per-token spend for the traffic that never needed a frontier model - by triage, not by a blanket rule.
Every request is scored, only requests above the live threshold escalate, and every routing decision is journalled with the inputs that produced it.
It replaces 'trust the vendor's security page' with artifacts you can run.
The product ships a machine-readable disclosure register with an enforcing gate - and at its last ruling, on 3 August 2026, that gate was red on its own product, refusing entries whose fix was asserted but never proven by a firing negative control.
What it decides, and what you decide
Each gate below is a control enforced in the software itself — not a policy statement about how it should be used.
- Route selection: local or escalate, decided per request with no prompt to the operator
- Threshold movement: the escalation boundary is rewritten on every request
- Prompt refusal: a hostile prompt is rejected outright with no human review
- Output redaction, squad dispatch across eight agent roles, and unsupervised restart
- Publish the port to the internetOperator
Nothing is published automatically. Every tunnel start is an admin-authenticated, deliberate act, and it is written into the ledger.
- Allow or forbid cloud escalationAdministrator
An admin-only setting. It ships armed permissive - so if a deployment requires that no prompt ever reaches a third-party model, this is the switch to close first, and closing it produces a refusal rather than a silent reroute.
- Demand an attestationOperator
Attestation is operator-triggered and admin-authenticated. It records; it does not gate admission - and this page does not claim it does.
- The desktop passphrase gateOperator
First launch demands a passphrase, five failures trigger escalating lockout, and signing out disarms the remembered device. No credential material is written to the removable drive.
- The ship gateOperator, at build time
The packaging step runs the probe suite before it will produce an installer. This is a gate on the builder, not on the user.
How it is built
- Four-engine rig (CPU + iGPU + dGPU + NPU)
- Zero cloud cost - local object store
- Risk-scored adaptive dispatch
- Prompt-injection refusal at the door
- Streaming output redaction
- Operator-gated tunnel ingress
- TPM 2.0 attestation with honest software fallback
- Eight-role agent squad
- Loopback-only serving path
- Prompt-injection refusal before dispatch
- Per-install minted credentials, no shipped defaults
- Origin-locked dashboard access
- Memory-hard sign-in with escalating lockout
- Device-sealed session tokens
What is running inside it
Every row below is attributed to this system alone and carries the state it is actually in — installed, present in source, or an honest seam.
- Installed
- present and in use in this system's own tree.
- In source
- present in source; not installed, or behind a try/except. Not a shipped capability.
- Seam
- an honest, fail-closed seam. No implementation is wired behind it.
Two local serving engines, selected per request
In sourceTwo distinct local inference servers run side by side and each request is directed to one of them by its risk score - a routing decision, made per request, between engines that are both on this machine.
Risk-scored adaptive dispatch
In sourceThe escalation boundary is a live threshold that recalibrates against a target error rate as traffic arrives, and every routing decision is recorded together with the threshold that produced it.
Noise IK encrypted tunnel
In sourceIngress runs over a mutually authenticated handshake pattern with modern classical primitives. Classical, and named as classical: there is no post-quantum claim on this system.
Three-of-N co-signed inter-process messages
In sourceMessages between components carry independent co-signatures and a quorum is required before one is acted on. The primitive is a symmetric one, so this is co-signing, not post-quantum protection, and the source file says so itself.
TPM 2.0 attestation surface with honest reporting
In sourceThe gateway can quote the machine's boot measurements on demand and bind the digest into its witness ledger. It records; it does not gate admission, and this page does not claim it does. Where no hardware root is present the console says software fallback in plain words.
Dual-subsystem GPU and NPU engine (Level Zero)
In sourceSource for a low-level engine addressing the discrete GPU and the neural accelerator through one interface ships in the tree. Whether it is compiled into the shipped gateway has not been verified, and this page does not assert that it is.
Uncore prefetch governor for the host CPU generation
In sourceSource for a memory-prefetch governor tuned to this processor generation ships in the tree. Build state unverified, and stated as unverified.
Native security daemon
In sourceSource for a compiled out-of-process security watcher ships in the tree. Build state unverified, and stated as unverified.
Machine-readable disclosure register with an enforcing ship gate
In sourceThe product publishes its own disclosure register and the packaging step will not emit an installer while the gate is red - and at its last ruling, on 3 August 2026, the gate was red on its own product. A build system that will not let its own vendor claim a green is a stronger claim than a row of green ticks.
Shipped adversarial defect probes
InstalledExecutable probes ship inside the repository rather than living in a test plan, so an evaluator can run the adversarial checks rather than read about them. Their current pass state has not been re-run for this page and is not asserted here.
Eight-role agent squad matrix
In sourceWork is dispatched across eight declared operating roles rather than one general-purpose loop, so what each role may do is written down before it runs.
How to reach it
Tartarus Cloud
Local-first today. Public gateway access is not yet scheduled - join the waiting list.
Visit tartarus.aisystemsbymarjerla.com