Built to survive a bank's security review.
LegacyLift runs some of your most sensitive code and produces evidence your risk and audit teams will rely on. Here is exactly how we keep it safe, and how we let you prove it.
Your code runs in a locked box.
Untrusted migrated code is never executed in our control plane. It runs inside an isolation boundary and comes back as plain data, so a hostile or buggy program cannot reach anything it should not.
- Zero network egress: no exfiltration, no phone-home
- Read-only filesystem, ephemeral workspace destroyed after each run
- Dropped Linux capabilities, non-root, no-new-privileges
- CPU, memory, and process caps stop runaway or fork-bomb code
- Control-plane secrets are never passed to the runner
It refuses rather than fake it.
A certification-grade run requires a real isolation boundary. If one is not available, LegacyLift refuses to run rather than silently drop to a weaker sandbox and imply a guarantee it cannot make.
- Certification never runs in a non-boundary sandbox
- Every result records exactly how and where it was executed
The proof cannot mark its own homework.
Certification evidence is held out from the data that produced the migration. A passing score is therefore independent of what created it, which is exactly what a model-risk function asks for.
- Teaching data and certification evidence are kept disjoint
- No result can certify a migration it helped create
Every result is signed and verifiable.
Results are sealed with an Ed25519 signature and a reproduction key, so your risk and audit teams can verify them independently, long after the run, without trusting us.
- Third-party-verifiable signature (public key, no shared secret)
- A reproduction key ties the result to its exact inputs
- A change in the engine automatically revokes affected results
Nothing ships without a person.
A human approves every change. The finalise gate blocks shipping on an unresolved, reachable, critical divergence, and every override is recorded with a reason.
- Per-change approve, edit, or reject
- The gate blocks a real critical divergence until it is resolved
- Overrides are audit-trailed, never silent bypasses
Designed to run inside your walls.
LegacyLift is a separate data-plane engine, built to deploy inside your own environment, so your source and data never have to leave your control.
- Runs in your private cloud, on-prem, or air-gapped
- Owner-scoped access with no cross-tenant reach
- Bounded APIs that never leak internal detail
Want the full security pack?
We will walk your security and risk teams through the architecture, the isolation model, and the evidence, and share the detailed documentation under NDA.