What happens when we're down.
Enforcement, signing, and verification run on your machines against artifacts you already hold. Our control plane administers accounts and routes evidence — it does not decide whether an action is allowed. The table below is the whole dependency picture, including the parts that do stop.
Policy evaluation
UnaffectedThe gate evaluates a signed policy bundle already on the device. No call leaves the host to decide allow or deny.
Receipt signing & chaining
UnaffectedSigning uses the workspace key held locally. The chain extends with us offline.
Receipt verification
UnaffectedVerification runs in a portable Apache-2.0 artifact that does not call Aarmos, now or in ten years.
Kill switch
UnaffectedThe local stop file and scoped panic act on the device, not through our API.
Recovery Point capture & restore
UnaffectedCapture, verify, and restore are local and offline. Verification uses no clock and no network.
Change Set apply
UnaffectedDraft, simulate, approve, activate, and rollback operate on local governance state.
Evidence delivery to your SIEM
DegradedManaged routing pauses and resumes when we return. Local NDJSON export and replication targets keep working the whole time.
Team & Enterprise console
UnavailableMembership, entitlements, SSO/SCIM administration, and the hosted dashboards depend on our control plane.
Entitlement checks for paid features
DegradedCached entitlements continue for the current period; new seat and tier changes wait for us.
You own the backup.
A Recovery Point names the policy, authority, identity, receipt head, and configuration a workspace can resume from — and contains none of them. Export the history as newline-delimited JSON, or replicate it straight from the device to S3, Azure Blob, Google Cloud Storage, or a Git repository you control. Those writes never pass through us, so your ability to recover does not depend on our availability.
Restore is all-or-nothing and returns a state, never a score: either recoverability is Complete, or every unverified component is named.
Honest limits.
- Local-first covers policy evaluation, receipt signing, and key custody. Account administration and managed evidence routing are hosted, and they stop when we do.
- A Recovery Point proves a state was observed and signed. It does not store the artifacts, so recovery still requires the bundle, keys, and receipts you kept.
- We publish no uptime guarantee here. Availability commitments belong in a contract, not on a marketing page.