Powered by ELYSÉA
Visible watermark in your interface. Mandatory from the first SDK call. It signals to your users that the ELYSÉA brain is active — that the 8 prohibitions apply to every exchange.
Trust mark — Integrity Label
A label your users can verify themselves.
Not a communications badge. An architectural fact: 8 prohibitions coded in the Guardian SDK, designed to apply at every call that goes through the pipeline, revocable within 48h if violated. Trust is not asked for — it is made verifiable.
Two levelsLevel 1 — Test and production Level 2 — Measured
One foundation.
Verified — public record
Label obtained after a measurement procedure on sealed corpora. Results are versioned and public — anyone can replicate the method. Your users can access the evidence directly.
Verified — public record
What this label says — and what it does not.
What “verified” means here
- — Measurements on sealed corpora: Precise pipeline states, documented at a given date, non-modifiable after recording. The measurement covers what happened — not what might happen.
- — Versioned and public evidence: Each measurement result is published with its method. Anyone with the same corpus can replicate the procedure and reach the same conclusions — or challenge them.
- — Reproducible method: The measurement procedure is open. It applies identically to every version of the pipeline — the label reflects a specific state, not a general promise.
What “verified” does NOT mean
- — Not a regulatory accreditation: no external accredited body issues this label.
- — Not a permanent state: the label reflects the state at the time of measurement. Subsequent versions undergo a new procedure.
- — Not sufficient regulatory compliance on its own: your auditors and you decide what these records prove in your legal context.
EVIDENCE — PUBLICATION IN PROGRESS
Measurement results will be published here once the review is complete. No date announced — records will appear when available.
WHAT IT LOOKS LIKE
The label in your interface.
LEVEL 1 — TEST AND PRODUCTION
powered by
ELYSÉA
LEVEL 2 — VERIFIED
vérifié
ELYSÉA
IN CONTEXT — partner app example
8 design objectives
What the label is designed to signal.
P1.Inviolable D0 canonCRITICAL
Anti-domination, anti-dependency, anti-substitution, anti-manipulation: foundational architectural objective, fixed by canon. No builder configuration can weaken them.
P2.Sacred memoryCRITICAL
Designed so that no builder can directly read a user's memory: the pipeline is designed to block direct access (prohibition P2).
P3.Active crisis protectionCRITICAL
On any suicidal or immediate-danger signal, redirection to human resources (emergency services) is enforced. Doctrine adopted on 30/09/2026, applied by the deployed brain: in distress without suicidal ideation, orientation towards a person is expected; a helpline may be mentioned calmly, without a crisis posture. Designed to be non-disableable, non-filterable. Note: ELYSÉA redirects — it does not contact. The human procedure after triggering is the builder's responsibility (D3).
P4.Controlled cognitive pipeline
The LLM executes within the ELYSÉA pipeline — it does not bypass it. The 9 canon steps are designed to apply to every response.
P5.Transparent traceability
The "Powered by ELYSÉA" marking is designed to be displayed: the user is informed that the ELYSÉA brain is active in the app.
P6.Monitored compliance
ELYSÉA is designed to monitor drift through canon-compliance telemetry, without exposing any conversation data.
P7.Scoped consent
Designed so that no data is collected beyond the consent scope defined by the user.
P8.Label integrity
Displaying the "Verified — public record" label without active measurements triggers revocation. The label is not self-declared.
Why simulation is impossible
The label is not self-declared. To display “Powered by ELYSÉA”, an app must call the ELYSÉA API — and the SDK is designed to respond only if the 8 prohibitions are respected. The Guardian SDK is designed to block any response that violates P1, P2 or P3 and to record a telemetry alert.
P8 explicitly specifies: displaying the “Verified — public record” label without active measurements is grounds for immediate revocation. Intentional confusion is treated as a P1 violation — the most serious.
Withdrawal process: written notice to the builder, SDK access revoked within 48 hours. The key is then refused immediately, the SDK label shows “Not verified” and the withdrawal is entered in the public register of withdrawals, with the appeal route.
How your users verify
The UI component provided in the SDK (ElyseaPoweredBadge) automatically renders the app's verification level. It is linked in real time to the SDK access status — not a static asset.
For the “Verified — public record” level: a public consultation portal (in preparation) will allow your users to access the measurement evidence via your app's identifier. The record will be signed — not a static promise.
This mechanism is deliberately public. Trust is not asked for — it is made verifiable.
Label policy — what you commit to
By integrating the SDK and displaying the “Powered by ELYSÉA” label, the builder accepts the following obligations:
- — Not to bypass the Guardian SDK pipeline by any technical means.
- — To explicitly inform your users of the presence of the ELYSÉA brain in your interface.
- — To collect separate consent for each ELYSÉA memory access (distinct from app consent).
- — Not to commercialise, export or cross-reference user memory data.
- — To report to ELYSÉA any unexpected pipeline behaviour within 48h.
- — Not to present the label to an authority or client as proof of regulatory compliance without formal audit.
The label is not the reward. It is the consequence of the architecture.