Black
Nothing goes out.

VerbaPulse Black is built for isolated networks. The server installs from signed media, verifies its license offline and updates from signed packages, with no outbound connection.

Request access
Illustration · fictional example

Hi Sarah, happy to confirm that the fund will deliver at least 8% this year, so you can plan on that.

CriticalFinancial

Unqualified investment return guarantee enabling reliance by recipient.

More careful wording

is targeting an 8% return this year, but results may vary

The writer decides. The record keeps the risk type and the action, and never the text.

Check a draft →
Runs inYour isolated network
ModelOn your GPU server
Server outboundNone
InstallSigned offline media

Nothing leaves the server

The server makes no outbound connection. Installation, licensing and updates arrive on media your team verifies.

Use cases

Classified or restricted correspondence

Drafts written inside a closed network are checked on a server with no route out.

Critical operations

Installation, licensing and updates travel by media you verify yourself.

Exchange Server estates

A dedicated manifest supports organizations running their own mail servers.

Who it is for

  • Public sector and foreign affairs environments with air-gapped networks
  • Organizations with the strictest security requirements
  • Institutions that do not use Microsoft Entra or do not allow any server outbound connection

Model

The model is gpt-oss-120b, an open-weight model released under Apache 2.0 by a US developer, served with vLLM. Our adapter was trained on synthetic drafts and contains no customer data.

Data handling

Draft text, the flagged phrase, the suggested wording and the model's explanation are not stored by default. Only an event record is written to your database: department, platform, risk type, level, action and time.

Technical details
Stored in your environment
  • Event records: department, platform, risk type, level, action, time
  • User accounts and departments
  • Your policies and NDA records
  • Administrator activity
Not stored by default
  • Draft text
  • The flagged phrase
  • The suggested wording
  • The model's explanation

Security controls

Controls included in the installation, and the tests we have run.

Isolated analysis

Analysis and model containers sit on an internal network with no outbound route.

One port

One published port: 443, with your own TLS certificate.

Deny by default

The edge denies by default: only product paths reach the API; sign-up, payment and marketing routes are closed.

No root containers

Containers run without root privileges.

Signed license

The license is an Ed25519-signed file verified offline.

Honest failure

When the model cannot answer, the result says "not checked". A failure is never shown as clean.

Technical sheet

For your IT and security teams.

Architecture and data flow
  1. The Outlook add-in or browser extension sends the draft to the VerbaPulse server inside your environment over TLS.
  2. The API runs two parallel model calls: a general pass and a specialist pass for financial crime and competition language.
  3. Findings return to the writer with a reason and, where appropriate, a more careful wording. The writer decides.
  4. An event record is written to your database: department, platform, risk type, level, action and time.
Tests we have run

Prompt injection in quoted correspondence
Turkish 81/84, English 51/51. Attacker text in suggestions: 0. Synthetic set, October 2026

Container image scan (Trivy)
No critical findings, no fixable high findings. API image, October 2026

End-to-end test in a closed network
36 of 36 checks passed: media, install with the network cut, sign-in, offline analysis, license expiry and renewal, signed backup, signed update, full restart. October 2026

Outbound attempts during install and analysis
Zero from the API, model and proxy containers. October 2026

Identity and access
  • User activation tokens valid for 1 to 30 days
  • Password sign-in for the admin dashboard
  • Integration with your internal identity provider through a single-destination gateway, scoped during deployment planning
Hardware and capacity

12 seconds: about 400. 6 checks per user in the peak hour.

30 seconds: about 1,050. 6 checks per user in the peak hour.

Measured on one NVIDIA H100 PCIe 80 GB card with the full stack running, median email of 571 characters. Larger populations are sized with your team during planning.

Model weights need about 60 GB and the loaded model about 69 GB of GPU memory. Each installation runs on one GPU server with Docker Compose.

Installation and updates
  • Install media is prepared on a connected machine, signed and carried into your network
  • You pin the media key fingerprint through a second channel and verify before installing
  • The media includes a CycloneDX software bill of materials and can be verified by hand with OpenSSL
  • Signed offline license with a 14-day grace period; expiry and renewal were tested inside a closed network
  • Signed offline updates with sequence checks and automatic rollback if the health check fails
Outlook and mail compatibility
  • A dedicated manifest for Exchange Server, deployed by your administrators
  • Office.js is served from your own installation
  • Send-time checking was verified in our lab on Exchange Server SE with classic Outlook for Windows. We confirm your Exchange and Outlook versions during planning
  • The Outlook client on a user's computer may send its own Office telemetry, which the server installation does not control
Under your control
  • Content storage is off by default and stays with your organization if enabled
  • Event records remain in your database under your own retention policy
  • A signed, metadata-only CSV export feeds your SIEM
  • Backups are signed. Keep them on encrypted storage
Does anything leave our network?

The server makes no outbound connection, and our closed-network test recorded no outbound attempts from its containers during installation and analysis. User computers keep whatever connections your organization allows.

How do updates reach the network?

As signed packages carried by your team. The server checks signature, version, sequence and file hashes, refuses older packages and rolls back automatically if the new version fails its health check.

Can we try Black before buying?

Organizations evaluating Black start with an Enclave pilot on the same engine. Talk to us about your network.

Is draft text used to train a model?

No. The model runs in your environment and VerbaPulse has no access to your drafts. Our adapter was trained on synthetic data.

Does VerbaPulse give legal advice?

No. It raises compliance risk signals and offers more careful wording. Your legal and compliance teams keep their review and their decisions.

Which languages are measured on this deployment?

Turkish and English. Talk to us if your teams write mainly in another language.

Compare the editions

SovereignEnclaveBlack
Where it runsYour private cloud or your own cloud tenancyYour data center, on your own GPU hardwareAn isolated network with no internet path
Model locationOn your GPU instance in that environmentOn your GPU serverOn your GPU server
Analysis pathAnalysis servers have no outbound routeAnalysis servers have no outbound routeAnalysis servers have no outbound route
Outbound connectionOne: Microsoft sign-in keys (login.microsoftonline.com)One: Microsoft sign-in keys (login.microsoftonline.com)None
IdentityMicrosoft EntraMicrosoft EntraActivation tokens, your internal identity provider
UpdatesScheduled with our teamScheduled with our teamSigned offline packages with automatic rollback

Plan your deployment with our team.

We start with a technical discussion about your network, identity provider and user count.

Plan a conversation