One signed binary that produces PCI DSS 12.3.3 and FIPS 140-3 evidence entirely on your own hardware. No upload, no telemetry, no account required to run a scan. For the environments where sending source code to a SaaS is not a preference but a contractual bar — and for the assessors who work inside them.
Binaries are released behind one short form; the verification metadata is not. Every SBOM, the SHA256SUMS file and its Ed25519 signature are public, so your security reviewer can read what is inside before anyone fills in anything. An unlicensed install runs at full detection strength and writes complete evidence packs, watermarked UNLICENSED BUILD — NOT VALID AS EVIDENCE.
macOS (Apple Silicon and Intel) and Linux x86-64, each published with its SHA-256, a CycloneDX 1.6 SBOM, and a checksum file signed with the pinned Ed25519 release key. The Linux build is unsigned — no Linux code-signing scheme exists — and the download page says so in the table rather than in a footnote.
Defense contractors, banks, and critical-infrastructure operators are frequently barred by contract — and sometimes by classification — from sending source code or configuration to a third-party service. A cloud scanner cannot bid on that work at all. CipherM Desktop reads the filesystem in front of it and writes its output beside it. Nothing transits your boundary.
A QSA arrives on site needing 12.3.3 evidence and will not work from a command line. The localhost dashboard gives them a scan button, a findings table they can filter by control, and a signed PDF at the end. One assessor becomes a repeatable channel across every client they audit.
A single static executable. No runtime, no interpreter, no installer, no admin rights. Copy it onto the machine — including a machine with no route to the internet.
$ chmod +x cipherm && ./cipherm version cipherm 1.0.0 · engine 0.3.0 · bundle 2026.09 (published 2026-07-30)
Point it at source, configuration, certificates, and TLS endpoints on your own network. Every byte analysed stays on the machine. There is no telemetry and no outbound call to make.
$ ./cipherm scan ./payments-platform --serve scanning 41,882 files · 169 rules · bundle 2026.09 findings 1,204 · quantum-vulnerable 318 · non-FIPS modules 27 dashboard → http://127.0.0.1:7777
The dashboard opens on 127.0.0.1 — a real interface, not a wall of terminal output, so an auditor who has never touched a CLI can work through findings, filter by control, and annotate exceptions.
A CycloneDX 1.6 CBOM plus a signed PDF: cryptographic inventory summary, control-by-control mapping, crypto-agility scoring, and a prioritised migration plan. Every page stamps the engine version, rule-bundle version, and bundle publish date.
$ ./cipherm report --format=audit-pack --out ./evidence/ wrote cbom.cdx.json · audit-pack.html · inventory-m2302.csv signed with bundle 2026.09 · freshness GREEN (0 days)
NIST deprecations, CMVP status changes, and new CVEs ship as signed rule bundles — data, never a new binary. Import one from a file so an offline network stays current without ever connecting.
$ ./cipherm rules import rules-2026.09.crb signature OK · counter 2 > 1 · 169 rules loaded
Cryptographic guidance moves — NIST deprecations, CMVP status changes, new CVEs. A local tool cannot silently refresh itself, so freshness is made explicit rather than assumed. Every report carries its provenance on the page.
Engine version, rule-bundle version, bundle publish date, and bundle age in days at scan time. A reviewer can tell at a glance what the finding was judged against.
Green under 30 days. Amber to 90. Red beyond. Past 120 days the audit pack is watermarked NOT VALID AS EVIDENCE rather than quietly generating.
Bundles carry a detached signature verified against a key pinned in the binary, and a monotonic counter so an older bundle cannot be rolled back over a newer one.
Most teams should not licence this. If your code can leave your network, the fixed-price engagement on the pricing page is cheaper and faster — we run the scan and sign the evidence for you. Licence the binary when that is impossible: when source cannot transit your boundary, or when you run inventory often enough that doing it yourself wins. Annual licences include the rule-bundle subscription for the term.
defense contractors · classified networks · banks with no-egress policies
QSAs · audit practices running crypto inventory at volume
PCI Level 1 service providers running continuous inventory in-house
Design-partner pricing is available for the first three customers in each segment, in exchange for a logo, a case study, and an introduction — discounted, never free, with renewal at list.
What is in scope, whether the environment is air-gapped, and which framework the evidence has to satisfy. If CipherM Desktop is the wrong tool for you, you will be told so on this call.
A time-limited entitlement file and the current bundle. Run it against your real estate, behind your own boundary. Nothing is transmitted, so there is no data-handling review to clear first.
A fixed annual quote, an order form, the binary's SBOM, and a security questionnaire response. Federal and defense buyers get procurement documentation and reference calls.
Signed binary, signed entitlement file with an expiry, and the current rule bundle — delivered by whatever channel your environment permits, including physical transfer. Licence checking is offline and never phones home.
Bundles ship on a regular cadence for the licence term. Your reports tell you when a bundle is ageing; you do not need a sales email to find out.
CipherM Desktop is built for organisations that must produce cryptographic evidence repeatedly and cannot let code leave the building. If that is not you, two cheaper things will serve you better:
CipherM Desktop is shipping. Leave an address and you get the signed binary, the current rule bundle, and a scoping call — not a drip sequence. Rule bundle 2026.09is signed by the pinned production release key, so every evidence pack it emits is audit-grade the moment you install it.
You do not have to wait for a reply to try it. Download the binary now — one short form, full detection, watermarked output until a licence is installed. The SBOM and checksums are public and need no form.