TRX Canopy · in operation
Sustainable intelligence. Governed by proof. Protected by design.
A hybrid Rust and Python framework installed at the exact point where all of the organisation's inference already passes. It doesn't ask your team to switch tools.
Membrane · before dispatch
Deterministic content linter
Membrane inspects every request before it leaves your network and blocks what can't circulate.
National IDs verified by check digit, cards by Luhn, email, secret patterns, regex and your own dictionary. Detection persists a content hash, never the text.
Core v2 · what goes in and out
FinOps optimisation
The kernel trims tool output before it returns to the model, and the panel shows where the AI budget is going.
Rust binary compiled into the hot path of the Python API. What it doesn't recognise, like JSON and search output, passes through intact by a logged decision.
Audit · sealed layers
A trail no one rewrites
Every call leaves a chained, sealed record, and the panel also shows the calls where a control didn't apply, with the reason.
Append-only, chain-sealed log. Proof of governance isn't the happy path. It's the list of cases where the rule didn't apply, and why.
Organisation · Area · Project · Key
Real-time visibility
Cost, tokens, energy, and blocks by area, by project, and by key, aggregated on the server, not in the browser.
Every virtual key has its own budget, rate limit, and allowed models.
Architecture · every module in operation
Three families, one system
Dossel is what gets tracked, Plâncton is where the call travels, Esporo governs and records. Every box in this diagram exists in the product today and has a matching endpoint, screen, table, or test.
Dossel · what gets tracked
Overview
entry panel
TRX Core
Savings Mode
GreenOps
energy · TpW
Alerts
real-time posture
Plâncton · where the call travels
Internal apps and agents
the organisation's own app
Coding tools
Claude Code
Speaks the Anthropic Messages dialect natively.
Internal SDKs
any HTTP client
Multi-provider proxy
OpenAI + Anthropic
Routing and failover
cost · latency
GATEWAY
FinOps
cost by area
Membrane
DLP before dispatch
Providers
Forge
internal models
Synapse
MCP servers
Grid
GPU fleet
Catalogue
published models
Esporo · governs and records
Organisation
tenant · area
Licence
contracted plan
Access
SSO · OIDC/SAML
Privacy
GDPR actions
Settings
preferences
Audit — four layers
Trail
append-only audit_log, trigger
Chained seal
per-row hash chain
Encrypted ledger
usage sealed in a daily batch
External anchoring
TSA RFC 3161, outside the operator
Evidence pack: signed ZIP with the trail, usage telemetry, Membrane detections, and privacy actions — capped by row count, never silently truncated.
Gateway · architecture
All traffic passes through a single point of control
Origin
Claude Code, SDK, or internal app
TRX GATEWAY
/gateway/v1/chat/completions
/messages
Providers
The lit point travels the line in a loop — it's the call in transit. Real product modules: Membrane (DLP before dispatch), FinOps and GreenOps (cost and energy), and routing by budget and latency.
Gateway · model catalogue
One entry point, every model behind it
Your application talks to TRX Canopy. Routing, failover, usage policy, and cost by area stay in the gateway — switching providers doesn't change a single line on the client side.
Gateway · Virtual Key
One key per area, with its own budget and limits
Every area of the organisation gets a virtual key — with its own budget cap, rate limit, and allowed models. The gateway authenticates against it, applies policy, and only then dispatches to the provider.
Anthropic
DeepSeek
OpenAI
Vertex
Membrane
FinOps
Virtual Key
sk-trx-eng-••••
Gateway · coding tools
Point Claude Code at the TRX Gateway
The gateway natively speaks the Anthropic Messages dialect — Claude Code points at TRX with no manual translation, and every team inherits centralised logs, usage policy, cost, and access control through its own area's virtual key.
Welcome to Claude Code!
/help for help · /status for your status
cwd: ~/your-company/engineering
Membrane · DLP before dispatch
Nothing sensitive leaves before passing through Membrane
Deterministic detectors inspect every call before dispatch to the provider — national IDs with check-digit validation, cards (Luhn), email, secret patterns, and a dictionary. Membrane persists a content hash, never the text.
Architecture indicators
0text persisted
Membrane detection
Sensitive data found becomes a content hash. The original text never enters the database, not even for administrators.
1record / request
Telemetry
How much it cost, how much energy it used, what was blocked, and who did what. One event per request, aggregated on the server.
3states per decision
Yes · No · Pending
An unfilled regulatory decision stays visibly pending. Silence is never read as approval.
Architecture indicators, verifiable in the product. Measured savings figures are published separately, always with the source and measurement date.
Sovereignty · two delivery models
Managed cloud, or inside your own premises
Canopy Cloud
Gateway managed by TRX22. Point to the base URL and the panel responds the same day — no infrastructure to provision.
Canopy On-Premise / Offline
For when data can't leave the premises. The same kernel runs inside the customer's perimeter, including with no outbound internet.
Screens in operation
Eight modules, one panel
Overview
Gateway
FinOps
GreenOps
Grid
Membrane
Audit
Organisation
The hierarchy is the same across all of them: Organisation, Area, Project, and virtual Key. Every key carries its own budget, rate limit, and allowed models.
One line changes. Everything else stays the same.
The gateway is OpenAI-compatible: the team swaps the base URL, not the tool.
// The gateway is OpenAI-compatible: only the base URL changes, // not the code you already wrote. const cliente = new OpenAI({ baseURL: "https://canopy.trx22.space/v1", apiKey: process.env.CANOPY_CHAVE_VIRTUAL, });