Horizon seals declared facts.
Declared by humans or systems. Sealed without interpretation.
Horizon is a neutral, append-only infrastructure that seals security and crisis facts as they are declared, without deciding, approving, or interfering with response operations.
- Capture facts during real incidents, not after
- Independent, cryptographically verifiable evidence
- No workflow, no approval, no operational friction
Horizon is Decision Evidence Infrastructure.
It produces verifiable facts about decisions without interpreting, enforcing, or governing them.
When facts can no longer be proven post-incident
During a major security incident:
- decisions are urgent,
- channels are informal,
- approvals are verbal,
- actions happen before documentation.
Weeks later, the questions arrive:
- Who knew what, and when?
- What was declared, and by whom?
- Which decisions were taken under pressure?
- What evidence actually exists?
At that point, reality is reconstructed from emails, chat logs, partial system traces, and human memory.
That reconstruction is fragile.
How Horizon seals facts
- 1A fact is declared by an actor
- 2Horizon processes the declaration
- 3The fact is hashed and signed
- 4A sealed_at timestamp is assigned
- 5The fact is appended to an immutable chain
Example of a sealed fact
{
"fact_id": "fact-01HRX7KQNB4GZJT8WVMC3YP5D2",
"stream_id": "HZN-034",
"parent_fact_id": "fact-01HRX7JHMA3FYK9RVNLB2XP4C1",
"actor": "ops-lead@acme-corp.com",
"sealed_at_ms": 1706270102437,
"custom_payload": {
"action": "stop_service",
"target": "payment-gateway-eu-west-1",
"reason": "memory_leak_detected",
"submitted_at_ms": 1706270100000,
"channel": "runbook_terminal",
"incident_ref": "INC-2024-00742"
},
"attachments_manifest": [],
"prev_hash": "8a3f2b1c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
"fact_hash": "c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
"signature": "MEUCIQC8xK2vPzYnRjH4mN5oP6qRsT3uVwX9yZ0aB1cD2eF3gAIgH4iJ5kL6mN7oP8qR9sT0uV1wX2yZ3aB4cD5eF6gH7iJ="
}Horizon does not decide what this fact means.
It only proves that it was declared and sealed at that moment.
Post-incident timeline
Timeline ordered by sealing time (sealed_at)
| Time | Actor | Payload | Sealed |
|---|---|---|---|
| 11:50:00 | monitoring@ | metric=memory_usage, threshold=95% | ✓ a1b2c3...d4e5f6 |
| 11:52:00 | ops-lead@ | action=stop_service, target=payment-gateway-eu-west-1 | ✓ b2c3d4...e5f6a7 |
| 11:53:00 | cto@ | message=Proceed with controlled shutdown., channel=email | ✓ c3d4e5...f6a7b8 |
| 11:55:02 | ops-lead@ | method=kubectl_drain, target=payment-gateway-eu-west-1 | ✓ d4e5f6...a7b8c9 |
| 12:00:00 | monitoring@ | observation=service_stopped, traffic_redirected=true | ✓ e5f6a7...b8c9d0 |
Horizon shows what was declared. You draw the conclusions.
How Horizon seals facts
A fact is simply something declared by an identified actor, at a given moment.
When a fact is declared, during a crisis, an exception, or normal operations, Horizon:
- assigns a single authoritative timestamp (sealed_at),
- stores the content as fully opaque data,
- cryptographically links it to the previous fact.
Facts are appended to a Facts Stream:
- append-only by construction,
- with no business state,
- no opening or closing,
- and no imposed causality.
Later, additional facts may be declared as evaluations of previous facts.
Horizon:
- records the declared relationship,
- seals the evaluation,
- does not interpret its meaning.
Compliance, legitimacy, responsibility, or fault are always external to Horizon.
Horizon produces structured, verifiable evidence. Without producing judgment.
Built for scrutiny, whenever it happens.
After an incident, Horizon allows you to show:
- what was declared,
- by whom,
- when Horizon received proof of it,
- in what factual sequence,
- and which evaluations were later declared.
Without log interpretation. Without narrative reconstruction.
Why CISOs rely on Horizon
- Incidents escape ideal workflows
- Reality is judged after the fact
- Personal and organizational exposure is real
- Logs are necessary but insufficient
Horizon provides independent evidence, not explanations.
Who else relies on it?
Horizon aligns security, engineering, risk, and legal around facts.
Engineering / CTO
Append-only, API, non-intrusive, no runtime impact.
Risk
Traceability of exceptions, continuity, after-the-fact clarity.
Legal
No qualification, no decision, neutral and opposable facts.
What Horizon is not
Horizon complements them by recording what they cannot guarantee.
Horizon provides indisputable evidence of what was declared during a security incident, by whom, and when it was sealed.
The system of record for incident facts.