Our PCIe card, running Sigmix-authored firmware — scrubbing & audit, in dedicated silicon.
Explore Sigmix Guard
Every request served on-box, sealed from the internet.
See your postureAn independent layer that scrubs sensitive data and anchors a tamper-evident audit trail on every Sigmix appliance today — now moving into our own proprietary PCIe card, separate from the host OS. Purpose-built, brandable, and sovereign by design.
// Sigmix-authored firmware · vetted supply chain · ships on every appliance today
◆ Sigmix Guard™ · PCIe
Guard is not a model, an accelerator or a firewall. It does two specific things on every request that crosses the appliance — and it does them independently of the software that could otherwise be asked to look the other way.
Saudi National ID / Iqama, IBAN, payment-card and credential patterns are detected and redacted before documents enter your knowledge base — or before a response leaves the box. It runs on the request path, not as an after-the-fact report.
Every request is hashed into a chained audit anchor. The appliance's FIPS-validated TPM 2.0 signs the exported anchor, which replicates to your SIEM or WORM store — an independent integrity record that does not depend on the appliance staying honest.
Everything below happens inside your building. Guard is in the middle of it — not bolted on at the edge, and not reading a log afterwards.
A prompt or a document from your staff.
ID, Iqama, IBAN, card and credential patterns redacted.
Inference runs on your own hardware.
Hashed, chained, TPM-signed, replicated to your SIEM.
Returned to the user. Egress: 0 bytes.
// scrub happens before the model sees it · anchor happens after the model answers · neither step is optional
A security control that can take your AI offline is a control your team will eventually be asked to disable. Guard is built so that never becomes the trade-off.
Scrubbing and anchoring run in dedicated silicon, separate from the host OS — so the protection does not share fate with the software it is protecting, and adds acceleration as it lands.
If the card is ever absent or faulted, the identical protection runs in software on the same appliance. Inference is never blocked; the safeguard is never lost.
Installs in any Sigmix appliance
Security claims get repeated in procurement documents long after the person who wrote them has left. So here is the precise version, in the words we are willing to have quoted back to us.
The root of trust remains the appliance's FIPS-validated TPM 2.0. Guard does not replace it, extend its certification, or inherit it. Guard enforces scrubbing and produces the audit chain; the TPM is what signs the exported anchor and makes it independently verifiable.
Related, and just as important: the appliance uses FIPS-validated crypto modules. That is not the same claim as a "FIPS-certified appliance", and we do not make the second one.
An independent enforcement layer on the request path · a scrubber that runs before the model sees your data · a chained, TPM-signed audit anchor you can replicate off-box · our own firmware on our own card.
Not the certified root of trust · not a FIPS certification for the appliance · not an accelerator for inference · not a gate on your deployment · not a replacement for your own controls and review.
The useful conversation about Guard is a technical one — the pattern set, where the anchors land, how it maps to your NCA and SAMA obligations, and what we are not claiming. Book the briefing and bring the people who will have to defend the choice.