Cryptographically Verifiable
Compliance & Identity Governance
Aphantos proves who had access to what, when, and why — with cryptographic evidence.
A graph-native compliance engine, it unifies Identity Governance (IGA), Risk Management (GRC), and Endpoint Security (EDR) into a single mathematical ledger secured by Polynomial Graph Commitments.
Visualizing the Compliance Graph
Aphantos models identities, systems, policies, and threats as nodes and edges. Interact with the live mock graphs below to see how it operates.
The Unified Security Fabric
Three core products and two specialized modules, built natively on the high-performance Aphantos Core graph engine.
Aphantos IGA
Identity Governance & Administration. Dynamic integration with enterprise identity directories (AWS IAM, Entra ID, Workday, plus template configurations). Just-in-Time access, PAM, and automated Separation of Duties audits.
- Directory Integration Templates
- JIT Privileged Access
- Automated Access Reviews
Aphantos GRC
Governance, Risk, and Compliance. Dynamic policy engine with real-time assurance summaries, risk radars, and mapping of 420+ controls across SOC 2, ISO 27001, NIS 2, DORA, and GDPR.
- Dynamic Risk Radars
- 40+ Compliance Frameworks
- Real-time Control Evidence
Aphantos EDR
Endpoint Detection & Response. Lightweight endpoint telemetry with behavioral threat detection, kernel-level eBPF probes, and automatic mapping to MITRE ATT&CK frameworks.
- eBPF Kernel Probes
- MITRE ATT&CK Mapping
- Real-time Telemetry Ingestion
Aphantos GDPR (Beta)
Privacy & Data Protection. Zero-knowledge DSAR processing, consent lifecycle tracking, and research-stage cryptographic deletion proofs validating data deletion under zero-trust privacy audits.
- ZK Deletion Proofs (Roadmap)
- DSAR Automation Workflows
- Consent Ledger Auditing
Aphantos PAM
Privileged Access Management. Native AES-256-GCM encrypted credential vault, session recording, and credential rotation. Fully integrated into the core IGA governance workflow.
- AES-256-GCM Vault
- Active Session Recording
- JIT Rotation Workflows
Aphantos Core
The high-performance graph engine. Written in Rust, it utilizes SuccinctGraph encoding, Dynamic Elias-Fano data structures, HNSW vector indexing, and Raft consensus.
- Sub-microsecond Graph Traversals
- Raft & SWIM Gossip
- PGM Learned Indexing
Polynomial Graph Commitments
Aphantos implements **Polynomial Graph Commitments (PGC)** to prove the compliance and authorization state of the entire system. Instead of trusting raw database logs, external auditors can verify cryptographic proofs.
Zero-Knowledge Auditing
Prove that all active user privileges conform to Separation of Duties (SoD) policies without exposing any actual user names or roles to third-party auditors.
KZG Commitments
Authorization states are mapped to polynomials. A single 48-byte cryptographic commitment secures millions of relations, evaluatable in O(1) time.
Incremental Proof Updates
As access changes are processed, proofs are updated incrementally, avoiding complete database recalculations while keeping the audit state live.
Aphantos Query Language (AQL)
Graph queries compiled to highly optimized Rust traversals. Tap the buttons to load and run sample queries.
// Load query...// Run query to view output...Polynomial Graph Commitments (PGC)
Academic preprint describing the mathematical backing of Aphantos' zero-knowledge compliance verification.
Polynomial Graph Commitments: Succinct Compliance Verification on Dynamic Heterogeneous Graphs
Abstract: We introduce Polynomial Graph Commitments (PGC), a novel cryptographic primitive designed for verifiably proving properties of dynamic heterogeneous graphs. By mapping nodes and edge adjacency matrices to bivariate polynomials over finite fields, we construct succinct zero-knowledge evaluations utilizing KZG polynomial commitments. PGC enables an untrusted graph database provider to prove compliance constraints, such as Separation of Duties (SoD) and transitive authorization limits, in $O(1)$ proof verification time and $O(d)$ evaluation size, where $d$ represents the degree of the query path. We show that our scheme maintains privacy guarantees for node identifiers and labels, making it suitable for distributed security auditing under zero-trust assumptions.
Performance Benchmarks
Aphantos (SuccinctGraph Engine in Rust) compared against traditional relational and graph databases on complex authorization path traversals.
Sub-Microsecond Operations
Traditional graph databases require joining multiple index structures or traversing deep pointer networks, which degrades performance as the graph depth increases.
Aphantos represents the graph using **Succinct Elias-Fano CSR** structures. Combined with PGM learned indices, lookups are reduced to O(1) and fit entirely inside CPU L2/L3 cache.
* Benchmarks are indicative, measured under standardized workloads (100k nodes, 1.5M relations). Detailed reproducibility steps and synthetic workload generation scripts are documented in the PGC repository.
Traversal Latency (Lower is Better)
Secure Your Enterprise Identity Graph
Deploy Aphantos in your private cloud, verify compliance mathematically, and achieve evidence-backed zero-trust identity security.
Interested in self-hosted pilots, customized enterprise SLA packages, or custom directory connectors? Get in touch.