Glasswall GenesisCDR Tool
Glasswall HaloServer
Glasswall MeteorDesktop
Compliance by territory
One engine, three products
Glasswall treats every file as untrusted, then validates it against the file-type specification and rebuilds it to a safe, standards-conformant copy. Unlike antivirus, sandboxing and EDR, it does not wait to detect a known threat. Glasswall reports 100% of malicious files neutralised across 8.27 million tested. The same patented CDR engine runs on the model your trust boundary requires: Genesis, Halo or Meteor, with AI-powered threat prediction scoring risk alongside. Glasswall builds the engine; Safeware delivers and supports it across APAC.
How Glasswall CDR works
Glasswall does not examine a file and decide whether to trust it. It takes the file apart, keeps only what the format's published specification allows, and manufactures a new one from what remains. There is no verdict to get wrong, and none of the original bytes reach you.
The file is broken into its constituent structures and mapped against its manufacturer's published specification, so every part of it is either something the format allows or it is not.
Structures that are unknown, invalid or malformed are repaired to that specification. Nothing is set aside for a person to judge later.
High-risk active content is removed to your policy: macros, embedded scripts, OLE objects. What goes is a setting you control, not a judgement the engine makes on your behalf.
A new file is generated from scratch from what remains, following the format's specification. Original file chunks are not copied into a template.
Semantic checks confirm the rebuilt file is intact, and it arrives fully functional in under a second: CMYK images accurate, embedded fonts present, coordinates untouched.
Deployment models
The decision framework is simple: match the model to where the file actually needs to be rebuilt. Halo covers the high-volume paths files already move through, and its Zero Trust Kiosk checks removable media at the door, Genesis is the engine itself on the command line, the Embedded Engine puts the rebuild inside your own software, and Meteor works where a server cannot reach.
Glasswall Halo
Halo is Kubernetes-native, so it runs on the managed control plane you already buy: Azure AKS, Amazon EKS, Google GKE or Oracle OKE. It auto-scales horizontally under high-volume file flows and puts the rebuild inline on the paths files already travel, integrated through the Integration APIs, Web gateway integration and Microsoft 365 storage protection.
Glasswall Halo
Or run the cluster yourself. A private Kubernetes cluster in your own datacentre or your own cloud subscription, on the virtual hosts you already operate: VMware vSphere, Proxmox or Amazon EC2. Same engine and the same policy model, on hardware you control.
Glasswall Halo
For sites that do not run Kubernetes themselves, Halo ships as a sealed virtual machine image, OVA or VHD: RHEL 9 hardened to DISA STIG with FIPS enabled, running single-node RKE2, dropped straight into the hypervisor you already operate. Same engine and the same policy model, with nothing for your team to assemble.
Glasswall Halo
No cluster to stand up and nothing to operate. Safeware hosts Halo in our own infrastructure and runs it for you; you integrate through the Integration APIs or Web gateway integration.
Glasswall Halo
USB sticks, SD cards and discs are checked at the door, before their files reach your network. Encrypted drives are unlocked at the kiosk, the files go through Halo and your other checks, and the engineer collects what passed. One kiosk can run Halo by itself with no network connection, or many kiosks can share a central Halo on your network.
Glasswall Genesis
The CDR engine itself, as one self-contained binary driven from the command line, and the same engine Halo and Meteor run. Any language that can start a process can call it, so it embeds in an OEM product just as readily as it drops into a build pipeline or a container step, on Linux, Windows and macOS, x64 and Arm64, with the runtime compiled in so there is nothing to install first.
Glasswall Embedded Engine
The other way to embed. Where Genesis is invoked as a process, the Embedded Engine links in as a native library: a C/C++ core with Java, Python and C# wrappers, so the file is rebuilt in process, inside your own binary, before your own code opens it. Choose it over the Genesis CLI when in-process is a hard requirement rather than a preference.
Glasswall Embedded Engine
For a cross-domain solution, the Embedded Engine rebuilds the file, then Transform to XML rewrites it as simple XML that a diode or gateway can check against a schema on the far side. The XML is turned back into the original format on arrival and checked again before the file reaches the high-trust network. Assessable against cross-domain control sets, not itself accredited.
Glasswall Meteor
A single Windows installer with watched input and output folders: drop a file in, collect a rebuilt copy out, no integration work. Files are cleaned on the endpoint, and Meteor Pro extends the same engine across 200+ local and cloud storage platforms.
Glasswall Meteor
Runs fully disconnected inside an air-gapped, classified or in-country network: no internet dependency and no cloud call-out while a file is processed, with updates and policy delivered as offline packages. Files, policy and audit logs stay inside your boundary.
CDR tool
The CDR engine itself, as one self-contained binary. Take it on its own when the rebuild has to happen inside something you already own: your own product, a CI/CD pipeline, a cross-domain guard or a process running on the tactical edge.
Native-format rebuild
A geospatial file is layers: imagery, vector overlays, terrain and structured metadata. Flatten it to PDF and all of it collapses into a picture, which is exactly what the analyst needed to keep. Glasswall rebuilds the file in its own format instead.
Server
Genesis running as a service, at the scale a gateway needs. Halo puts the rebuild inline on the paths files already travel: upload portals, email, web gateways, Microsoft 365 and, at the Zero Trust Kiosk, removable media.
This is the deployment for when the volume is continuous and the control has to be central: policy, dashboards, authentication and a per-file verdict record your auditors can read.
Desktop
Genesis on the endpoint, for the files that never touch a gateway. Drop a file in and a rebuilt copy comes back, on the desktop and across local and cloud storage.
It is the deployment for boundaries a server cannot reach: removable-media kiosks, analyst workstations inside a classified network, and post-breach work where nothing from before the incident should be trusted.
Deployment Comparison
One engine, three ways to reach it. Halo and Meteor both run Genesis, so each rebuilds against the same published format specifications; what differs is where the rebuild happens and what it plugs into.
| Capability | Genesis |  Halo |  Meteor |
|---|---|---|---|
| Deployment model | Self-contained binary or container | Cloud, on-premises or air-gapped, on Kubernetes or as a virtual machine appliance | Desktop, on-premises or air-gapped |
| Best for | CDR inside your own application or pipeline | Portal, email and gateway file flows at scale | Desktop, local and air-gapped file cleaning |
| Typical deployments | OEM products, CI/CD, cross-domain guards, tactical edge | Upload portals, email and web gateways, Microsoft 365 estates, removable media (Zero Trust Kiosk) | Removable-media kiosks, analyst desktops, post-breach remediation |
| Integration | Command line (CLI) | Integration APIs, Web gateway integration, Microsoft 365 storage protection | Desktop agent, folder sync, batch, inline |
| Runs on | Windows, Linux, macOS (x86-64 and Arm64) | Your Kubernetes cluster, on-premises or in your cloud | Windows |
| Connectivity | Wherever the host runs, including fully offline | Online, on-premises or fully air-gapped | Online, offline or fully air-gapped |
| File coverage | 140+ file extensions, the same engine in all three | Office, PDF, image and archive formats | Office, PDF, image and archive formats |
| Key differentiator | Specialist formats and up to 2x faster processing, memory-safe | Inline CDR plus file reputation (ReversingLabs) and multi-AV scanning at gateway and M365 scale | No data leaves the boundary, no telemetry egress, no cloud callback |
| Safeware role (APAC) | Integration advisory and QA | Architecture, integration and production support | Deployment hardening and governance |
File support
The same Genesis engine underneath all three products, so coverage does not change with the deployment you choose. Format names are the manufacturers' own.
PDF · OOXML · Legacy Office · ODF · RTF
PE · ELF · Mach-O · LNK
EML · MSG · Nested attachment processing
NITF, including MIL-STD-2500C and TRE analysis · SIDD · GPX · KML · GeoJSON · SHP · DWG · DXF · STEP AP242
H.264 · H.265 · MPEG-2 · MP4 · MP3 · WAV
JSON · CSV · SVG · HTML · CSS
JPEG · PNG · TIFF · GIF · BMP · HEIF · JPEG 2000 · WebP · WSQ · DICOM
ZIP · 7Z · RAR · TAR · GZ · BZ2 · XZ · ISO
A document comes back a document. Files are not flattened to PDF to make them safe.
CMYK-accurate images, embedded fonts intact, coordinates untouched. A rebuilt file nobody has to ask about.
Alongside the rebuild
Every product above rebuilds a file. AI-powered threat prediction answers a different question: how likely was that file to be malicious in the first place.
Machine-learning models trained on the deep structural telemetry that CDR already produces score each PDF, DOCX and XLSX file, which surfaces unknown and zero-day threats before anyone opens them and gives a SOC something to triage on. It runs with any of the three, not instead of them.
Shared Capabilities
API references, specifications and release notes are published by Glasswall. For scoping, integration and an APAC proof of concept, Safeware is your point of contact.
Book a Demo
Share your operating context and file workflows. We'll map an implementation path for cloud, on-premises, and isolated environments with clear delivery milestones.
