No single point of trust. By construction.
Five questions decide whether you actually control your data. SkyeConnex answers all five in the architecture itself — cryptographic isolation, geometric distribution, jurisdictional policy, portable custody and governed compute, composed so that nothing depends on one party behaving honestly. Not us. Not your providers. Not anyone.
Each layer below is marked Live or Scoped — shipped, or specified and not yet shipped. The category comparison carries the same statuses.
Cryptographic isolation Live
Pillar 01 · Security — Who can see it?
Every file gets a unique data-encryption key (DEK). The DEK is wrapped by a User Master Key (UMK) that the server never holds in unwrapped form. Frame-level AES-256-GCM with deterministic per-frame IVs and AAD binding tying ciphertext to file identity.
-
CRYPTO
AES-256-GCM frame encryption
Per-frame deterministic IV bound to (file_id ‖ frame_index) prevents nonce-reuse classes of attack. AAD ties ciphertext to (file_id, frame_idx, encrypted_size) — shard substitution is detected at decrypt.
-
KEY-WRAP
AES Key Wrap + ML-KEM-1024 hybrid
The DEK is wrapped with AES-KW (SP 800-38F). The wrap is composed with ML-KEM-1024 (FIPS 203) for hybrid post-quantum protection. A future cryptographically relevant quantum computer must also defeat AES to read the data.
-
UMK
Zero-knowledge User Master Key
The UMK never reaches the server in unwrapped form. It is derived from the user's password (scrypt KDF) or recovery key, both of which only the user holds.
-
RECOVERY
Out-of-band recovery key & duress mode
A 24-character recovery key independently wraps the UMK so password loss does not mean data loss. A secondary duress password unwraps a limited shadow scope under coercion.
-
SPLIT
Split-Authority Decryption (Shamir Secret Sharing)
For the most sensitive scopes, an M-of-N custodian quorum is required to unlock. No single custodian can compel access.
NIST-published primitives only.
Every primitive in active use is NIST-published. No proprietary algorithms — a deliberate choice that compresses the FIPS 140-3, Common Criteria, and FedRAMP certification path from years to months.
SkyeLedger — custody attestation chain Scoped
Architecture and specification complete; not yet shipped. A company-rooted, hash-chained record of custody events, signed with ML-DSA-87 and built to be omission-evident — the property that matters, since an audit log you can quietly delete from proves nothing. Rooting the chain in the company rather than in SkyeConnex is what lets it be checked without trusting us.
Today the platform keeps conventional access and provenance records. They are useful operationally and they are not the same claim: they detect tampering with an entry, not the removal of one.
Geometric distribution Live
Pillar 02 · Legal — Who can seize it?
Every file is split into ~5 MB frames, and each frame is independently Reed-Solomon encoded. The baseline is RS(5,2) — seven shards, five data and two parity, each to a different provider in your connexion set, so losing or compromising any two still leaves the data fully reconstructable. That baseline is the default, not a ceiling.
The coding is resolved per upload, after geo-policy has narrowed the provider pool — so your jurisdictional rules shape the durability maths rather than fighting them. Where a company enables adaptive coding, parity widens automatically when the pool that a file will actually land on could not survive losing a vendor at baseline. Two guarantees hold throughout: the frame size negotiated with the client never changes, and durability only ever widens — it is never reduced to buy back storage.
5 data + 2 parity shards
Reed-Solomon RS(5,2) per frame by default — tolerates loss of any two of seven providers, and reveals nothing readable when one is compromised. Adaptive coding widens that automatically when your policy or the file calls for it.
Idempotent upload keys
Per-shard upload keys make scatter retryable without duplication. Failed provider writes recover without re-encrypting the source.
Per-shard SHA-256 integrity
Every shard carries a SHA-256 hash for bit-rot detection. Read paths walk all seven shards in parallel and return as soon as any five succeed.
Jurisdictional policy Live
Pillar 03 · Residency — Where does it really live?
Every provider connexion is region-tagged — auto-detected from the provider's API or explicitly set by the operator. The platform enforces an account-wide geo-fencing policy at upload time, with confidence-graded endpoint resolution surfacing across every sovereignty view.
-
ALLOW
Allow-list mode
Only listed jurisdictions accept new shards. Outside-policy providers are excluded from scatter.
-
BLOCK
Block-list mode
Named jurisdictions are excluded from scatter. All other providers are eligible.
-
STRICT
Strict-mode hooks
Fail the upload rather than degrade silently when policy cannot be satisfied. Compliance integrity over availability.
-
CASCADE
Effective-policy cascade
Company beats per-account, reseller beats company. The resolver returns (value, source) tuples — every setting in the UI shows where it came from.
-
ACK
Sovereign acknowledgment workflow
Attaching a sovereign-class connexion (on-prem MinIO, customer VPC) requires explicit operator acknowledgment — captured with timestamp and identity as a compliance-audit artefact.
Portable custody Live
Pillar 04 · Portability — Can you leave — and can they make you?
SkyeConnex is orchestration, not a cloud. You keep the providers you already buy from; custody is layered over them. That is what makes leaving cheap — there is no SkyeConnex storage tier to migrate off, because your bytes were never in one.
Bring your own cloud
Your existing hyperscaler, regional and on-prem buckets become the connexion set. SkyeBucket presents a SigV4-compatible S3 endpoint in front of them, so tools that speak S3 need no modification. The gateway path is the one place custody is traded for compatibility: it holds a wrapped key and sees plaintext on PUT. The native client path does not — keys stay inside your boundary.
Exit and continuity
Escrow sits with the anchor host in each country, not with us. Recovery tooling reassembles data without SkyeConnex in the path, and a lost shard node can be reconstituted on a different provider from the surviving shards. Leaving is a configuration change, not a migration project.
Standard interfaces
S3 over SigV4 — interoperability verified with MariaDB, DuckDB and ClickHouse — plus a Windows virtual drive and an Outlook add-in. Custody attaches to the interfaces your systems already use rather than asking them to learn a new one.
Governed compute Live
Pillar 05 · Algorithmic — What’s learning from it?
The first four layers make data unreadable to everyone holding it. That is worth little if using the data means handing a plaintext copy to somebody else's GPU. SkyeGXU closes the gap: shards reassemble only inside the client boundary, the work runs on hardware you own, and what comes back out is written into custody under the same policy. Running in production since 2025.
Reassembly stays inside your boundary
The compute node is a member of the client boundary, not a destination outside it. Shards are gathered and reconstructed there and nowhere else — the same threshold rules that govern storage govern the read that feeds a model.
Your hardware, federated
Agents run on customer-owned GPUs and CPUs, with NVIDIA PAIR-compatible routing and a coordinator that places work by device class and jurisdiction. Capacity you already own becomes the substrate; nothing is rented from us to make it work.
Outputs return to custody
Embeddings and derived artefacts are written back as custody objects under the originating file’s geo-policy — so a vector built from a file that may not leave a jurisdiction does not leave it either. Derivatives inherit the constraint rather than escaping it.
Policy-bound workloads Scoped
Specified and not yet shipped. Models and encoders register as signed adapter blobs — an image hash, an I/O contract and a declared resource ask — bound per collection, so what a workload is permitted to read is a property of the collection rather than of whoever launched the job.
It is designed to sit under the analytics platforms and notebooks you already run, not to replace them. Until it ships, encoder provenance is recorded at dispatch but the binding is not enforced.
Sovereignty, on screen, in real time.
SkyeMap is the live sovereignty surface: account-wide score, per-jurisdiction roll-up across PIPEDA, GDPR, UK-GDPR, SOC2, FedRAMP, APP, APPI, MAS, LGPD, POPIA, PDPL, per-folder breakdown, per-file drill-down showing which jurisdictions hold its seven shards.
Confidence-graded endpoint resolution
Every provider endpoint on the SkyeMap is resolved through a confidence-ranked hierarchy: Probed → Declared → Observed → Country-only → Unknown. Each renders with a distinct pin colour so evidence and claims are visually distinct — making sovereignty operationally enforceable, not aspirational.
Threat Simulator
Click-to-block any country and the platform recomputes shards lost, files at risk, files unrecoverable, and the sovereignty-score delta in real time. RS(5,2)-aware: a file is only marked unrecoverable when at least three of seven shards land in blocked countries. Preset scenarios: Five Eyes, CLOUD Act bloc, China, Russia.
Memory-flat. Resumable. Async by default.
Frames are encrypted with AES-256-GCM as they ingest — never accumulated in plaintext, never held in memory beyond a single ~5 MB chunk. Async scatter returns the HTTP 202 the moment raw bytes hit tmpfs staging; the encode-encrypt-RS-scatter pipeline runs as a Celery task.
Five-endpoint chunked upload
Init · Put · Status · Complete · Cancel. An interrupted upload resumes by re-PUTting only the missing chunks. Server-side staging TTL is 24 hours.
Multipart over the same pipeline
S3 multipart PUTs from third-party SDKs reframe behind the gateway and join the same encrypt-encode-scatter path as native uploads. One canonical integrity model.
HA via Redis-backed primitives
Leader locks, frame-level work queues, shard-distribution barriers. The same binary runs on a laptop and on a five-node cluster.
The architecture is the proof.
Book a briefing. Live walkthrough of CloudRAID, the SkyeMap, SkyeGXU running on customer hardware, the Threat Simulator, and a signed-report verification.