Sovereignty

Sovereignty you can read in the code.

One sentence we treat as a contract term

Sovereignty is a deployment posture we enforce in code — fully self-hosted in your region by construction.

Most vendors answer the residency question with a policy PDF. Ours is answered by the deployment itself. The diagram below is not a marketing metaphor — it is the wiring: what runs inside your boundary, who holds the keys, the one arrow that is allowed out, and the two places where the system prefers to stop rather than leak.

Aurenta deployment architecture The customer's VPC is the outer boundary. Inside it: customer-held keys, in-region OCR, retrieval and telemetry components each asserting residency, a fail-closed router that raises rather than falling back to any foreign API, an egress manifest whose digests-only arrow is the only line leaving the boundary, and a production boot gate that refuses to start half-configured. Outside the boundary, a foreign cloud API box is reachable only by a crossed-out, refused path. CUSTOMER VPC — YOUR REGION the outer boundary — every component deploys inside it OUTSIDE YOUR REGION nothing routes here by default CUSTOMER-HELD KEYS evidence signing · held by you IN-REGION OCR residency asserted ✓ IN-REGION RETRIEVAL residency asserted ✓ IN-REGION TELEMETRY residency asserted ✓ FAIL-CLOSED ROUTER raises rather than falling back to any foreign API REFUSED FOREIGN CLOUD API no fallback path exists EGRESS MANIFEST every outbound byte, enumerated digests only · human-triggered no document ever crosses PRODUCTION BOOT GATE refuses to start half-configured
The deployment boundary as the code enforces it — one outbound arrow, and it carries digests only.

The outer boundary is your VPC

Aurenta ships as a self-hosted deployment into your virtual private cloud, in your region. The boundary on the diagram is where every component actually runs — ingestion, computation, storage, the evidence ledger. Nothing in the product assumes a connection back to us, which is why the residency answer survives due diligence: there is no second diagram.

Customer-held keys

Evidence roots are Ed25519-signed with keys you hold — HSM-ready (PKCS#11) by design. We cannot sign on your behalf, and that is the point: an evidence trail is only worth something when the vendor is structurally unable to manufacture it.

In-region OCR, retrieval and telemetry

The components most vendors quietly outsource — OCR, retrieval, even telemetry — run inside the boundary, and each one asserts its residency at runtime rather than in a policy document. A component that cannot state where it runs is treated as a configuration failure, not a footnote.

The fail-closed router

Every model call passes through a router with one hard rule: if the in-region path is unavailable, it raises rather than falling back to any foreign API. There is no “temporary” cloud fallback, no degraded mode that quietly ships an invoice abroad. Failure is loud by design — the crossed-out arrow on the diagram is a code path that ends in an exception, not a retry.

The egress manifest

One arrow leaves the boundary. It carries digests only — cryptographic fingerprints, never documents — and it moves only when a human triggers it. Everything that crosses is enumerated in a manifest you can read, so “what left the building” is a question with an exact, inspectable answer.

The production boot gate

Half-configured deployments are how sovereignty erodes in practice. The production boot gate refuses to start if the configuration is incomplete — keys missing, residency unasserted, gates absent — so the system’s first act in production is to check itself, and its second is to say so.

Fail-closed egress, everywhere — provably complete

Every outbound data-bearing call — OCR, model, retrieval, telemetry, and the TRN-registry lookup — asserts in-region and raises rather than falling back, in sovereign and hybrid modes. The coverage is backed by a whole-repo egress inventory, so “fail-closed” means every seam, not most.

The boot gate is exhaustive and self-maintaining

The production gate that refuses to start half-configured now carries audited coverage and a meta-test — a new production-critical seam can’t ship without being gated.

Transmit-guard

If a deployment declares it transmits to an accredited service provider but no transmitter is wired, it refuses to start — filing can never silently no-op.

The six principles this diagram enforces — read the doctrine

Put the diagram in front of your CIO.

Book a demo and we will walk this architecture end to end — what runs where, who holds the keys, and exactly what the manifest lets out.

Book a demo