huereo / trust
Your data stays in your network, in India.
huereo runs inside your own network in India. Your data, keys and evidence never leave it. These are the measures behind that statement, and the limits we list plainly.
01 Security and privacy by construction
The measures behind the promise.
| Area | What is in place |
|---|---|
| Network | Offline by default; the engine also blocks outbound connections itself. The image downloads nothing at start-up or while running. |
| Container | Runs as a non-root user (uid 10001) on a read-only root filesystem; writes only to the state folder, the output folder and /tmp. A software bill of materials is recorded in the image. |
| Integrity | Every detection pack and the name model are hash-verified when loaded. Update bundles, the air-gapped bundle and licences are signed with Supermerco’s key: an installation that has our public key refuses an unsigned or altered one. |
| Keys | Generated and kept on your machine; rotation and bring-your-own-key; runs pin the key ids they used. |
| Releases | Approved and blocked results are never mixed; a failed or interrupted run’s partial output is moved out of the output folder. |
| Leftovers | Parsed copies of tables exist only for the run and are deleted when a crashed run is recovered; huereo purge deletes a finished run’s working data. |
| Names and hidden content | File and sheet names that hold personal data are replaced; hidden document parts are read or removed. |
| API | Token required beyond the local machine; protection against DNS rebinding and cross-site writes; request size limits; strict content security policy on the console. |
| Our access | None. Support works from a bundle with no data values; review scores hold counts only. |
02 Deployment
Inside your environment, with no outbound connection.
huereo needs no outbound connection in any deployment.
| Option | How |
|---|---|
| One server | Load the image; each command runs in a fresh container with no network, a read-only root and a non-root user |
| Kubernetes | Helm chart: the API and console run as a service, releases run as Jobs; image pinned by digest from your own registry |
| AWS, Azure, Google Cloud | Step-by-step guides for running in your own cloud account |
| Air-gapped sites | One signed bundle with both platform images and an installer that checks Supermerco’s signature and every file’s checksum before loading anything |
one serverdocker run --rm --network none --read-only --tmpfs /tmp \
-v /srv/huereo/state:/var/lib/huereo -v /srv/data:/data \
IMAGE run /data/input/loan_book.csv \
--contract /data/config/contract.yaml --out /data/output/release-01Commands
- Console and REST API
huereo serve runs a local REST API (/v1) and an offline web console that opens on an Overview of the installation (releases this month, what needs attention, the register of data shares, packs and licence) and covers releases, evidence, re-verification, comparisons and reviews. It binds to the local machine by default, needs a token to listen on any other address, and only reads and writes inside the folders you allow.
- Updates
Pack updates arrive as one file. You inspect and validate it, import it, then activate it when ready, and can roll back with one command. A file that is not signed by Supermerco, or does not match its checksums, is refused.
- Licence
A signed file, verified offline. Nothing calls home.
03 Speed and sizing
Measured, with the hardware named.
A table of 1 million rows releases end to end (detect, transform, verify, risk, utility, evidence) in about 9 minutes on a 4-vCPU machine, measured on 18 October 2026. Speed depends on the processor and grows with cores. Free text runs 5 to 10 times faster on an NVIDIA GPU, with the same findings.
| Resource | Recommendation |
|---|---|
| Memory | 4 GiB per release running at once; 8 GiB recommended. Tables are read in batches, so memory does not grow with row count. |
| CPU | 4 cores or more |
| Disk | About 3 GB for the image; free space of three times the input under the state and output folders while a release runs |
| Platforms | Linux on amd64 or arm64; Docker or Podman, rootless included |
| GPU (optional) | An NVIDIA T4 or better for text-heavy data (notes, documents, chats); the standard image is CPU-only, a GPU image is built on request. |
04 Limits at launch
What huereo does not do yet, listed plainly.
huereo capabilities lists every limitation, and every Passport repeats them.
- huereo reads exported files: CSV, Parquet, Excel, JSON, SQL dumps, documents and scans. Direct connections to databases and cloud storage come after launch.
- Names, places and organisations are found in the languages listed above. Text in other scripts is reported as a gap, never passed as clean.
- Pictures embedded in Word and HTML documents, and email attachments, are removed instead of read. Scans and PDFs are read with OCR in English and Hindi; pages read with low confidence are flagged for review.
- The DPDP pack is mapped against the official texts of the Act and the Rules. It is a technical mapping, not legal advice, and has not been reviewed by a lawyer; legal decisions stay with your DPO.
- Privacy Contracts are YAML files that huereo assess drafts for you. The console shows an Overview, releases, evidence, comparisons and reviews, but has no contract editor yet.
- Benchmarks are on public and synthetic data. Detection on your own data is measured in the pilot with huereo review.
- It runs on Linux servers (Intel/AMD) with Docker or Kubernetes. ARM and OpenShift support are being certified.
Bring one data share you need to send.
Run huereo on one of your own files on a one-hour call, or start a 30-day pilot on your server (₹9,900, credited in full to your plan). Or write to hello@supermerco.com.