01 — INFRASTRUCTURE RESILIENCE
Year 2038 time overflow.
At 03:14:07 UTC on January 19, 2038, signed 32-bit Unix time runs out. Systems that still count time that way, from embedded controllers and firmware to industrial devices, file formats and older databases, can fail, reset or mishandle the timestamps on logs and certificates. Most organizations can’t say which of their assets are affected.
EpochGuard discovers assets, collects evidence from operating systems, binaries, firmware and dependencies, and classifies each one’s risk with a stated confidence. Anything it can’t prove is reported as unknown, never as safe.
STATUS Working prototype: discovery, analysis and reporting engines; field validation next.
02 — APPLIED CRYPTOGRAPHY
Keys people can use, strength you can measure.
Weak, reused and written-down secrets remain one of the most common ways in. We generate human-memorable keys whose strength is computed exactly rather than estimated, then seal data with standard, well-studied primitives: Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption.
Novel Encryption, published with Ruption AI, draws keys from a chosen book and can write sealed messages as natural-looking text in that book’s voice. The security comes from the measured random key and the cryptography, never from the text.
STATUS Working command-line tool, specification and white paper.
03 — DATA PROTECTION
Find the secret before it leaks.
A detection engine that finds credentials (private keys, cloud and API tokens, JWTs, passwords in URLs) and personal data (email addresses, Social Security numbers, card numbers, phone numbers, names), then redacts, numbers or pseudonymizes them with keyed HMAC-SHA256 so records still match across systems.
It does no I/O and reads no clock, so the same audited engine runs on servers, on desktops and in the browser through WebAssembly, and sensitive documents never have to leave the machine to be cleaned.
STATUS Shared engine in use across several of our applications.
04 — VERIFIABLE ISOLATION
A hypervisor that explains itself.
A virtual machine monitor in Rust whose every sizing and boot decision comes from one pure policy core with no unsafe code. The same core compiles to WebAssembly, so the policy can be run and checked under Wasmtime and in a browser and gives the same answer everywhere.
Every decision is recorded with the rule that fired and its reason. Requests are honored or refused, never silently changed, so a failed launch is a diagnosis rather than a mystery.
STATUS Research prototype; arm64 Linux guests boot on Apple silicon.