Palimpsests runs language models entirely on hardware you control and writes a tamper-evident record of every request — the data residency and the audit trail that regulated and air-gapped deployments depend on, without a byte crossing your boundary.
Every layer is stamped and joined to the one beneath it. The surface changes turn by turn; the record underneath stays recoverable and can’t be quietly rewritten. That is the palimpsest — and the audit trail.
Patient records under GDPR. Positions on a trading desk. Anything inside a classified or air-gapped network. When the data can’t reach a hosted API, neither can your inference.
Palimpsests keeps the whole loop — model, attention state, and log — on the machine where the data already sits. Nothing is uploaded, nothing is phoned home, and the only thing you export is a record you can verify without exposing what it recorded.
The recurring idea: hold computed state instead of rebuilding it. Each capability is a named lever with an honest note on where it earns its keep.
A system prompt or long shared context is processed a single time and held warm, then reused across every request that shares it — instead of being re-read on each call.
state held across requestsMulti-step tool calling without rebuilding the conversation at each step. Measured on Intel Arc (Vulkan) across 1.5B and 7B, it holds even with a hand-tuned llama-server — parity, stated plainly, not a headline number.
measured · parity with a tuned serverAttention state is serialized to a validated frame format and restored across sessions and processes. The computed layer survives the process that produced it — and the frame is checked before it’s trusted.
validated frame · restored across runsA well-tuned server uses these levers too. Where Palimpsests earns its keep is doing all of it locally, with a record. The concurrency case for Shared Prefix and KV Persistence is still under measurement — it gets reported here when it’s real, and not before.
Every request leaves a tamper-evident entry, chained by hash so the log can’t be silently altered. That’s the record-keeping substrate the EU AI Act’s logging expectations rest on — kept locally, verifiable without revealing what it holds. And the software itself carries the same discipline.
Each entry references the one before it. Remove or edit a layer and the chain breaks — tampering is detectable, not deniable.
Published to PyPI with Sigstore provenance, so a build can be traced back to the source and workflow that produced it.
An SPDX SBOM ships with the release — the dependency inventory a Cyber Resilience Act review asks for, ready rather than reconstructed.
A self-attested Open Source Project Security baseline, a published threat model, and Atheris fuzzing in the pipeline. Apache-2.0, so you can read all of it.
Palimpsests doesn’t make you compliant with any of these on its own. It supplies the one runtime primitive each act actually leans on — residency, record-keeping, or supply-chain integrity — and leaves the rest to how you deploy. Every title links to the source text on EUR-Lex.
The hash-chained request log is the automatic record-keeping a high-risk system has to keep — held locally, and verifiable without exposing what it recorded.
Inference runs where the data already sits, so personal data never leaves the controller — no third-country transfer to justify — and the tamper-evident log speaks to integrity of processing.
Ships the machine-readable SBOM, signed releases, a published threat model and coordinated vulnerability handling the CRA makes mandatory for products with digital elements.
Running the model in-house takes one ICT third-party dependency off the register, and the log gives financial entities defensible evidence for ICT-incident records. Support, not a full answer.
Provenance and the SBOM feed supply-chain security measures; the tamper-evident log backs the incident evidence essential and important entities have to produce.
Most landing pages overclaim here. This one draws the line, because for a regulated buyer the line is the credential.
Palimpsests is regulated-adjacent infrastructure. It carries the runtime obligations — residency, record-keeping, supply-chain integrity — and it does not discharge the ones that belong to how you deploy it.
It installs from PyPI and runs offline. Point it at a local GGUF model and the log starts writing itself. The quickstart lives in the README.
# Apache-2.0 · runs air-gapped · provenance on every release