Project status
Read this before you deploy anything
What Cardinal is, what it is not, and what you can and cannot expect from it.
A Londer project, in development
Londer builds Cardinal and holds the copyright. It is in development and pre-1.0: not sold, not offered as a service, and not part of any engagement or support agreement. Whether Londer later offers it as a product, publishes its code, or releases it more widely, and under what licence, is not yet decided.
Londer is its first user, not its only intended one, which is why it is built on standards and assumes nothing about any one organisation’s infrastructure.
A working pre-1.0, not finished software
Everything described on this site runs, and an end-to-end suite drives it against a real stack on every change. What that does not make it is finished.
What it is good for today
A pilot on services nobody would miss for an afternoon, evaluating the design, and finding what is wrong with it. What it is not yet for is the access you could not afford to lose: production systems, and the tools you would need to repair Cardinal itself.
The cryptography, the session handling and the policy evaluation have had no external review. Required before 1.0.
No stable API and no supported upgrade path between versions. Read every release’s notes first.
When it is down, nobody signs in to anything it protects. Plan for that before it is load-bearing.
Not yet decided. No licence is granted and the code is not distributed. Provided as is.
How long a version is looked after is decided by Londer and promised to nobody outside it.
Passkey sign-in, OIDC, the proxy, SSH certificates, a Linux host, on every change.
Talk to us
Questions, a pilot, or a vulnerability to report
Write to Londer, the team behind Cardinal, whether you want to know if it fits your case, follow the project, or report a security issue.