Platform
Solutions
Industries
Resources
Company
Request a briefing
Data Sovereignty as a Service

They told you it's safe
because it's encrypted at rest.

At rest, in their datacentre, with their key. Encryption you don't hold is a policy, not a control.

Sovereignty by architecture,not by promise.

Request a briefing → Explore the platform
The Five Pillars

Residency answers one.
Architecture answers all five.

Most sovereignty conversations stop at pillar three. This is a walk through all five — each one a question a buyer eventually has to answer, and the architectural answer SkyeConnex gives it.

01 Security Who can see it?
02 Legal Who can seize it?
03 Residency Where does it really live?
04 Portability Can you leave?
05 Algorithmic What's learning from it?
Security

A breach of any one provider is a breach of nothing.

Who can see it? Conventional security is a wall you hope holds — and every operator, admin and provider behind it is another door. We don’t just lock your data, we scatter it: encrypted before it ever leaves your hands, then split into fragments no single provider can rebuild.

Per-file keys · AES-256-GCM · post-quantum ready today with ML-KEM-1024 · erasure coding that widens itself and never narrows

The SkyeConnex app showing what happens when a file is saved: seven endpoints feed a pipeline of hash, compress, generate DEK, encrypt, wrap DEK with post-quantum protection, erasure code, hash shards, route and distribute — fanning out to eleven storage providers across hot, cold and any tier.
Every save, end to end: hash → compress → generate DEK → encrypt → wrap the key with post-quantum protection → erasure-code → distribute across eleven providers. The plaintext never leaves your device.
Legal

You can’t hand over what you don’t hold.

Who can seize it? Residency doesn’t stop a subpoena — if your provider answers to a foreign government, so does your data, wherever the server happens to sit. No single operator or jurisdiction ever holds enough to rebuild it, so there is nothing complete to produce.

Signed audit trail · DGSI 100-8:2026 conformance · Protected B ceiling

The SkyeConnex Threat Simulator with the United States selected and CLOUD Act, Five Eyes, China and Russia offered as threat scenarios. It reports the blast radius: one affected provider, 3,148 of 18,401 shards lost, and 2,177 files still recoverable via Reed-Solomon.
Pick a jurisdiction and model the seizure. Here the United States cuts you off under the CLOUD Act: one provider gone, 3,148 shards lost — and the files rebuild from what is left.
Residency

Stop asserting residency. Start proving it.

Where does it really live? This is where sovereignty theatre lives: a maple leaf on the website while the keys and the control sit somewhere else entirely. You set the placement policy, every file obeys it — and the policy shapes the maths: the erasure coding is chosen against the provider pool your rules actually leave, so a tighter jurisdiction buys wider parity rather than thinner cover. When an auditor asks, you show them instead of reassuring them.

SkyeMap — live shard geography by file, folder and account · coding resolved per upload, after geo-policy

SkyeMap in the SkyeConnex app: a world map showing where a customer’s encrypted shards are stored across seven connexions, with per-provider shard counts and a location-confidence legend distinguishing traceroute-verified locations from declared-but-unverified ones.
SkyeMap, live. Seven connexions, 18,401 shards — and a confidence legend that separates what we verified by traceroute from what a provider merely claims.
Portability

Leaving should be your decision. So should staying.

Can you leave — and can they make you? A vendor you can’t leave sets your terms. A vendor who can switch you off sets them absolutely: sanctions and court orders have killed access to fully paid services overnight. Keep your hyperscalers, demoted to interchangeable shard buckets. When one fails, is acquired, or cuts you off, your data reconstitutes elsewhere and recovery runs without us.

Escrow-backed continuity · re-point one S3 endpoint and your tooling inherits it · no one provider can revoke what no one provider holds

The rebuild-shards dialog in the SkyeConnex app. With gDrive treated as unreachable, it offers to reconstruct the shards for 2,204 files from their siblings on the other connexions and lists eight targets, each shown with its provider mark and the region it sits in: Dropbox in Canada, Google Bucket in the United States, Microsoft Lakehouse, NeonDB, OneDrive and SkyeDrive in Canada, an S3 bucket in the Middle East and an Oracle bucket in Asia-Pacific.
A provider goes dark and you keep working. Shards for 2,204 files rebuild from parity onto any other connexion you pick — Azure, S3, Oracle, Google, whatever you already own.
Algorithmic

Use AI on your most sensitive data. Feed nobody else’s model.

What’s learning from it? Hand regulated data to someone else’s AI and you have disclosed it — you just called it a prompt. SkyeGXU runs training and inference against custody objects, reassembled only inside your boundary, on infrastructure you govern.

Governed distributed AI on customer-owned hardware since 2025

The SkyeGXU vector list in the SkyeConnex app. Three source assets — two PDFs and a photograph — each embedded on the customer’s own agents. The open row shows the document broken into 249 chunks, all 249 embedded across two named agents, with the vector drawn as a waveform, a radial signature and a value distribution, beside its dimensions, model, slowest agent and the hash of the toolchain that produced it.
Every vector records what produced it: the source asset in custody, the agents that embedded it, and a hash of the toolchain. Agents connect over MCP — the model comes to your data.
The compound effect
"An adversary attempting to read a single SkyeConnex file must simultaneously defeat the wrapped DEK, compel five providers across multiple jurisdictions, and complete both before the audit log surfaces the activity. There is no published successful attack against this composition."
The shift

A perimeter can only ever react.

It cannot act until something arrives at it. That is not a flaw in anyone’s product — it is what a perimeter is. The industry conceded this years ago and called it assume-breach, then answered it by reacting faster: detect sooner, respond sooner, contain sooner.

Defend the perimeter

Keep attackers out. When that fails, find out quickly and contain it. Every control in the chain works only while someone behaves — the alert fires, the team responds, the provider stays honest.

Still a promise to react.
Remove what it was guarding

Encrypted before it leaves your hands, then split into fragments no single provider can rebuild. The perimeter can be crossed. What is behind it does not reassemble.

Nothing to react to.

Cross the perimeter and you hold ciphertext fragments below the threshold that rebuilds them, with no key in the same jurisdiction. Endpoints still matter — plaintext lives where you work. Everywhere else, the breach stops being an event and becomes a non-result.

Free tools

Find out where you actually stand.

Three tools, no signup, nothing transmitted. All of them run entirely in your browser.

8 questions · 60 seconds

Sovereignty Score

Score your storage architecture out of 160 across cryptographic isolation, jurisdictional spread, compelled-disclosure resistance, post-quantum readiness and audit verifiability.

Score my architecture →
Dollars · 10-year view

Sovereignty Exposure

Model what a breach, an outage or a compelled disclosure actually costs you — then compare your single-vendor baseline against a sovereign posture.

Model my exposure →
One request · instant

Residency Latency Test

Measure the round trip to any vendor endpoint and see the furthest it can physically be. Light in fibre buys about 100 km per millisecond — so a residency claim has a speed limit you can check yourself.

Test a claim →
0.7×
stored volume
Sustainability

Resilience that costs less than a single copy.

Default 5+2 sharding with compression stores roughly 0.7× your original data and survives the loss of two locations — against about 3× for conventional replication. We also record the grid carbon band behind every endpoint, and say plainly where we don’t know.

See our sustainability posture →
From the desk All posts →
Commentary·12 Oct CSIS Just Said It Out Loud. Data Centres Are Targets. → Commentary·04 Oct Kingston Police Got Hacked. Good News, the Hacker Pinky Swore. → Commentary·02 Oct Ottawa Just Said Assume Breach. Out Loud. In Writing. → Commentary·25 Sep BARC Measured the Governance Gap. It’s Where We Said It Was. → Commentary·24 Sep Good News: Your Data Is Sovereign. Bad News: So Is the Coal Plant. →
Get in touch

Sovereignty is no longer a slide deck.

Forty-five minutes, live, on your own data. We'll show you all five pillars working — and you can decide for yourself.

Request a briefing → Read the architecture