Security & privacy

Your core logic never leaves the building.

PYD ENTERPRISES is self-hosted software built for networks with no internet route. It parses, extracts and exports entirely inside your perimeter, and PYD ENTERPRISES never receives your code.

Open the trust center Book technical walkthrough

egress verificationShell

$ kubectl -n modernization get networkpolicy
NAME               POD-SELECTOR   AGE
deny-all-egress    <none>         d
allow-in-cluster   app=pyd   d
 
$ kubectl -n modernization exec deploy/pyd-api -- \
    curl -sS -m 5 https://pydenterprises.com
curl: (28) Connection timed out after 5001 milliseconds
 
$ pyd license status
key CS-ENT-7F2A  mode offline  valid to 2027-11-30
online checks: none  telemetry: disabled (not built in)

100% air-gapped
Runs with no route to the internet. No telemetry, no license callbacks.
Zero code egress
Source, ASTs, rules and specs stay on your volumes.
Zero model training
Your code never trains any model, ours or a third party's.
FIPS 140-2 validated
Cryptographic operations use validated modules.
SOC 2 Type II · ISO 27001
Independent audit reports, shared under NDA.

Deployment architecture

Everything runs inside your perimeter.

Docker images or a Helm chart in your data center or private VPC on AWS, Azure or GCP. The only thing that ever crosses the air gap is inbound: a signed bundle and an offline key.

Read-only ingest

Source arrives through read-only mounts, Git clones or PDS exports. PYD ENTERPRISES never writes to your repositories or datasets.

Your identity, your keys

Users sign in through your SAML identity provider with SCIM provisioning. Encryption keys for the results store come from your KMS or HSM.

Optional model stays inside

If you enable rule naming with a language model, it is one you host in the perimeter. The deterministic engine decides what the code does.

Data-flow inspector

Pick any data class. See where it goes.

Every artifact PYD ENTERPRISES creates or touches, with its storage, encryption, access and retention.

INSPECT · SRCNever leaves the perimeter

Source code & copybooks

Git / PDS / Endevor
ingest pod
parser pods
results store

Stored in: Customer persistent volume
Encryption: AES-256 at rest, TLS 1.2+ between pods
Access: Customer RBAC via SAML SSO groups
Retention: Customer policy; purge per project with pyd project purge

Read through a read-only mount or clone. PYD ENTERPRISES never writes back to your repositories.

bytes sent to PYD ENTERPRISES by the software: 0

Offline licensing & updates

Updates that cross the air gap one way.

01Offline license keyIssued per site and per term, signed by PYD ENTERPRISES and verified locally. Entitlements (LOC, systems, seats) live inside the key, so nothing needs to phone home.
02Signed update bundleQuarterly releases and dialect packs ship as a single tarball: container images, Helm chart, SBOM and checksums, signed with our release key.
03Verify twiceCheck the signature and checksum on a connected workstation, then again inside the perimeter after transfer. The import refuses any image without a valid signature.
04Upgrade and roll backHelm upgrade inside your namespace. Keep the previous bundle for rollback; scan results and sign-off history survive upgrades.

update across the air gapShell

1# 1. connected workstation: download and verify
2sha256sum -c pyd-2026.11.tar.sha256
3SIG=pyd-2026.11.tar.sig
4cosign verify-blob --key pyd-release.pub --signature $SIG pyd-2026.11.tar
5 
6# 2. move on approved media through your transfer process
7 
8# 3. inside the perimeter: verify again, then import
9pyd bundle verify ./pyd-2026.11.tar
10#  signature   OK  (pyd-release, P-384)
11#  sbom        OK  412 components, 0 unsigned
12#  dialects    ibm-cobol-6.4, mf-cobol, cics-bms, jcl-zos
13pyd bundle import ./pyd-2026.11.tar -r registry.internal
14helm upgrade pyd ./pyd-2026.11.tgz -n modernization

Trust center

SOC 2 Type II, ISO 27001, pen test summary and the security whitepaper.

Request any document under NDA. Most requests are answered within one business day by our Security & Compliance team.

Request documents security@pydenterprises.com

FAQ

What security teams ask first.

Report a vulnerability: security.txt

Does PYD ENTERPRISES ever see our source code?

No. The software runs on infrastructure you control and has no outbound channel to PYD ENTERPRISES. Our engineers only see what you choose to share in a support ticket, and the diagnostic tool redacts source text, identifiers and file paths by default.

Can we run PYD ENTERPRISES with egress completely blocked?

Yes, and most banks and agencies do. Install with a deny-all egress network policy, use an offline license key, and import updates as signed bundles. Security teams usually verify this before the first scan by attempting outbound connections from inside the namespace.

Is our code used to train AI models?

Never. PYD ENTERPRISES' extraction engine is deterministic and needs no training on your code. If you enable the optional language model for naming rules, it is a model you host inside your perimeter, and PYD ENTERPRISES does not collect its inputs or outputs.

What does FIPS 140-2 cover in PYD ENTERPRISES?

Cryptographic operations in the product, including TLS between services in the cluster, encryption of the results store and signature verification of license keys and bundles, use FIPS 140-2 validated cryptographic modules when FIPS mode is enabled at install. The validated module certificates are listed in the security whitepaper in the trust center.

How do we get the SOC 2 Type II report and ISO 27001 certificate?

Request them from the trust center. We share the SOC 2 Type II report, ISO 27001 certificate and Statement of Applicability, and the latest penetration test summary under a mutual NDA, usually within one business day.

Which cloud environments are supported?

Any Kubernetes cluster you run, including private VPCs on AWS, Azure and GCP, OpenShift and on-premise clusters, plus a single-node Docker install for evaluations. PYD ENTERPRISES needs no managed services from your cloud provider.

Stop spending six months reading legacy code by hand.

Run PYD ENTERPRISES on 100,000 lines of COBOL or Java in your private VPC and review OpenAPI specs and DMN tables tomorrow.

Start 14-day trial Schedule a technical walkthrough