Key register and approved key rotation for EU payment institutions

Bitting turns leak findings into the register an auditor reads. Each row holds a live key, what it opens, which services hold it, when it was last replaced and who approved that. For each live key Bitting prepares a rotation, a new key given to every holder in turn with the old one switched off last, and runs it once a named person signs.

Finding a leaked key is solved work, and finding every service that holds it is where Bitting's language model earns its keep. Fingerprints tie a key to the secrets and variables carrying it; following each through Helm values, Terraform modules and pipeline variables to a running service, and saying what stops if the key changes, takes reading, which a model Bitting tunes itself does on masked text.

Bitting's holder map never rotates a key on the model's judgment alone. When the model is less than nine in ten sure it has found every holder, it prepares nothing, asks the service's owner and waits. A platform lead approves every rotation, and the CTO also signs for a key marked critical. Owners' answers become labeled pairs of masked context and corrected link, which train the model only where a customer opts in.

Onboarding makes Bitting's compute bursty. A new customer's first read covers every commit in every repository, two years of CI logs and the chat history over several days, then falls to new commits and pipeline runs. A public supply-chain compromise brings a second burst, when every customer's CI logs are read again at once.

Bitting serves its own models on cloud GPU capacity we control in Stockholm. A payment institution cannot send a map of its payment systems to a model provider outside the EU, and key values never leave the customer's network: a small classifier inside the agent tells credentials from other strings there.

Bitting's holder model moves to weights fine-tuned on consented beta corrections in January 2027, trained on hourly GPUs in Stockholm. From July 2027 its steady load runs on GPUs reserved for twelve months in Stockholm, with hourly capacity kept for onboarding bursts, beside the register and logs, which have stayed on cloud infrastructure in Stockholm since the beta opened in September 2026.