Janus Edge for Government and Defense
Janus Edge is a self-hosted AI gateway that runs inside your own enclave, between your people and the models they use. Every request is tied to a signed-in person, checked against the models that person was granted, screened for sensitive data and written to an audit record you can forward to your SIEM. The FIPS edition runs its cryptography in a FIPS 140-3 validated module, the STIG configuration profile holds the settings your assessors expect, and the whole system runs air-gapped on an offline license. It is designed for air-gapped DoW (DoD) environments and designed to support your ATO.
The FIPS edition and the STIG profile are included in Business and Enterprise licenses and in the free 30-day trial.
Product brief PDF, two pages, US Letter
One checkpoint inside the enclave, between your people and every model.
Janus runs on your own servers, next to the models you host. People sign in with a smart card or your identity provider, and applications use service tokens. Requests to models on your own GPUs never leave the enclave. If your authorization allows a commercial provider, that traffic goes out through your egress proxy, and only after every check has passed. Each decision is written to the audit log and, if you set up forwarding, to your SIEM.
Six questions every AI rollout in a regulated enclave has to answer.
Handing out model access is easy. Showing an assessor who used which model, with what data, under which controls, is the hard part. Here is how Janus answers each question.
Which cryptographic module protects the data?
An assessor will ask for the module and its certificate, not for a vendor's assurance.
The Janus FIPS edition is the same source built with the Go Cryptographic Module v1.0.0, which holds CMVP certificate #5247, running in FIPS 140-3 approved mode. The binary refuses to start unless that module is linked with FIPS mode on, and janus --fips-status prints the edition, the module and the features it switches off, so the answer is something you can show.
How does a hardened configuration stay hardened?
Settings drift. Someone turns on plain HTTP for a test or shortens audit retention to save disk, and the system quietly leaves its baseline.
Setting JANUS_STIG_PROFILE=true puts Janus into its documented configuration for the DISA Application Security and Development STIG. Plain HTTP, SQLite, the evaluation sign-in, LDAP without certificate checks, untrusted upstream certificates, any phone-home and audit retention under 913 days each stop startup with a named error. Administrative changes are refused when their audit record cannot be written.
Can people sign in with their CAC?
Passwords alone don't fit an enclave where everyone already carries a smart card.
Janus accepts CAC and PIV certificates on its own TLS listener or from a trusted proxy that forwards the client certificate. The certificate must chain to an authority you configure and pass a revocation check, and it is matched to a person by UPN, email or DoD ID number (EDIPI). You can require administrators to use a card, and the DoD Notice and Consent Banner must be acknowledged before any sign-in.
Who used which model, from where, and did it work?
Investigators need sign-in and access records with an address and an outcome, in the system they already watch.
Janus records sign-ins, sign-outs, failed attempts, lockouts, time-outs, banner acknowledgments and refused requests with the source address and outcome, next to every administrative change. The audit page filters, sorts and exports to CSV in every edition, and each record can be forwarded to syslog or your SIEM over UDP, TCP or TLS, as RFC 5424 or CEF.
How do you keep sensitive data away from the wrong model?
People paste logs, configuration files and program names into prompts every day.
The Security Gateway inspects each prompt inside the enclave. It recognizes personal data such as Social Security numbers, 27 kinds of credentials and secrets, and the codenames on your own term lists, even when someone changes the spacing or swaps digits for letters. Each policy can record, redact or block, and a mandatory organization policy can't be loosened by a team.
Who gets which models, and how much can they use?
Without limits, one script can exhaust a GPU pool or a budget meant for everyone.
Signing in grants nothing. Administrators grant each model to a person, group, team or service token, and set quotas on tokens, spend or requests. Load-balanced pools spread a self-hosted model across several GPU servers by live load, and usage insights show what kinds of work people use AI for from category labels, without storing prompts.
What you get in the FIPS edition and STIG profile
Both ship in every release, from the same source and the same commit as the default edition. The STIG profile works in either edition; run it on the FIPS edition when you need validated cryptography.
Details are in the product documentation that ships with Janus: the FIPS edition, the STIG profile and the security settings guides.
- Cryptography
- FIPS 140-3: uses the validated Go Cryptographic Module (CMVP certificate #5247) in approved mode (FIPS edition). The binary refuses to start unless that module is linked with FIPS mode on.
- Delivery
- The container image
ghcr.io/torvanis/janus:<version>-fipsnext to the default image, plus FIPS edition binaries and offline image archives for Linux on amd64 and arm64. - Restricted features
- Features that need algorithms the module does not approve are switched off: SHA-1 authenticator codes, bcrypt password hashes from older releases, PDF report export, encrypted PDF attachments, the evaluation sign-in, LDAP without certificate verification and untrusted upstream certificates.
- STIG profile
- Built to the DISA Application Security and Development STIG. One switch,
JANUS_STIG_PROFILE=true, sets the STIG defaults and logs a startup line listing the profile in force. - Refused at startup
- Plain HTTP, SQLite, the evaluation sign-in, LDAP without certificate verification, untrusted upstream TLS, update checks and license sync, and audit retention under 913 days.
- Sessions and passwords
- Idle sign-out in minutes for people and for administrators, a longest session, sessions per person, lockout after failed attempts, and password length, complexity, history and age. Apply DoD STIG values fills in the STIG values for you to review and save.
- Notice and consent
- The DoD Notice and Consent Banner, or your own text, acknowledged before any sign-in method. The server refuses a sign-in without it.
- Smart cards
- CAC/PIV sign-in on Janus's own TLS listener or through a trusted proxy (X-Forwarded-Client-Cert), with chain and revocation checks and matching by UPN, email or EDIPI.
- Trust and revocation
- One outbound trust store with the DoD PKI root CAs (on by default in the FIPS edition), uploaded certificates and a certificate directory. OCSP and CRL revocation checking, set to hard in the STIG profile.
- Audit
- Sign-in and access records with source address and outcome, CSV export in every edition, forwarding to syslog or a SIEM, 913-day retention and fail-closed administrative changes in the STIG profile.
- Database
- PostgreSQL. The FIPS edition and the STIG profile both refuse SQLite.
- Offline operation
- Signed license keys verified with no network access. The STIG profile runs offline, so nothing contacts janusedge.com.
Proof you can put in front of an assessor.
Each binary describes itself, and the gateway logs what is in force when it starts. The output below is the format given in the product documentation, shortened.
$ janus --fips-status
{
"edition": "fips",
"fips140_enabled": true,
"module_version": "v1.0.0",
"validated_module": true,
"cmvp_certificate": "#5247",
"restricted_features": [ ... ]
}level=INFO msg="stig profile" enabled=true
database=postgres
transport=tls-terminating-proxy
offline=true
audit_retention_days=913
audit_fail_closed=true
totp_algorithm=hmac-sha256Buy it online from five seats, or by purchase order.
The FIPS edition and the STIG profile are Business features, so a small program can start with them without a sales cycle. Enterprise adds the contract terms and licensing that restricted environments usually need.
Business
The FIPS edition and STIG profile, bought on this site.
Business is sold per seat with a 5-seat minimum, billed monthly or annually, by card or US bank account, and you can add a tax ID and PO number to every invoice. For an air-gapped gateway, issue an offline key from the portal and carry each renewed key into the enclave after a renewal. A 30-day trial key includes both features.
- Janus FIPS edition and STIG configuration profile
- SSO groups, SCIM, LDAP and multiple identity providers
- Security Gateway enforcement: redact and block
- High availability and load-balanced model pools
Enterprise and Government
Perpetual keys, purchase orders and support under an SLA.
Enterprise is an annual contract, invoiced or paid by purchase order, with an MSA and DPA. For government and defense customers we can sell offline by purchase order and invoice, with keys delivered without the online portal. A perpetual key runs every release published on or before its maintenance date, indefinitely.
- Everything in Business, with unlimited seats and gateways
- Perpetual licenses for air-gapped and restricted environments
- Air-gap deployment support and priority support under an SLA
- Help with security questionnaires and procurement paperwork
Questions program offices ask
Anything else? Get in touch and a person will reply within one business day.
Which part of Janus holds the FIPS 140-3 validation?
The cryptographic module. The FIPS edition performs its cryptography in the Go Cryptographic Module v1.0.0, which is validated under CMVP certificate #5247, and runs it in approved mode. Janus is the application built on that module; it is not itself a validated module.
Does Janus need internet access?
No. Install from the offline archives or the offline image files, mount a signed license file, and Janus verifies it with keys built into the binary. The STIG profile turns off update checks and license sync, so nothing contacts janusedge.com. Your configured model providers are the only outbound connections, and only if you set them up.
Can we use the STIG profile without the FIPS edition?
Yes. The profile works in both editions. If your system needs validated cryptography, run the profile on the FIPS edition.
Can people in the enclave use commercial models?
Only if your authorization allows it. Janus can reach an approved provider through your HTTPS proxy, verifies the provider's certificate against your trust store, and runs the Security Gateway checks before anything is sent. Models on your own GPUs, served by vLLM, llama.cpp, Ollama or TEI, never leave the enclave.
What happens when a license expires on an air-gapped network?
Nothing that interrupts anyone's work. An expired Business or Enterprise key still lets the FIPS edition and the STIG profile start, and the gateway keeps serving requests; adding new items pauses until a current key is installed. Enterprise perpetual keys never expire for the releases they cover.
What database does Janus need?
PostgreSQL. The FIPS edition and the STIG profile both refuse SQLite, because the database STIG's controls can't apply to a file database. Configure PostgreSQL to authenticate with scram-sha-256.
Can we evaluate it before buying?
Yes. A 30-day trial key includes every Business feature, the FIPS edition and the STIG profile among them, and it is verified offline like any other key.
Take the brief to your program office.
The two-page product brief covers where Janus sits, what the FIPS edition and STIG profile provide, what we do not claim and how to buy. When you are ready to scope a deployment, we'll help with the paperwork.