Content-addressing + chain integrity
Used for atom hashing, RefreshAnchor chains, Merkle witnesses, certificate digests. Parallelizable + SIMD-accelerated; no successful collision attacks in published cryptanalysis.
posture as of 2026-05-28 · honest gaps disclosed below
A trust center that shows the work.
Sovereign Clearinghouse's compliance posture is structural, not promotional. Below is the factual state, what's certified, what's in flight, what we don't yet claim, and how an examiner verifies any of it independently of us. No marketing veneer.
Where we stand, certification-by-certification
Each row links to the underlying evidence + the owning party's name + the expected milestone date.
| Framework | Status | Owner | Next milestone |
|---|---|---|---|
| SOC 2 Type II | In flight | Vanta-managed audit | R3.1 kickoff → first report ~6 months |
| FIPS 140-3 / CMVP | Lab-engaged | NVLAP lab (atsec / Acumen / Lightship target) | R3.5 ACVP testing → CMVP submission queued |
| MiCA CASP sandbox | Application drafted | Compliance + Legal | R3.6 ESMA-affiliated NCA submission |
| FINTRAC MSB registration | Pending | Compliance + Legal | R3.6 application filing |
| GDPR Article 28 DPA | Draft ready | Outside counsel | R1.5 red-line + customer-counsel review |
| Bug bounty program | Private channel live | Security Lead | R3.4 HackerOne public program launch |
| External crypto review | Pending | Trail of Bits target | R3.2 engagement + report |
| External penetration test | Pending | NCC Group target | R3.3 engagement + report |
| Cyber liability + Tech E&O | Broker outreach | Ashley + Legal | R3.9 binding coverage |
| EAR / Wassenaar export-control | Draft analysis | Outside counsel | R3.10 counsel red-line + BIS notification |
We don't market certifications we don't hold. The Auditor Compliance Brief §10 lists every honest gap in detail.
Post-quantum from day one. NIST-standardised. Open-source verifier.
The substrate's cryptographic chain. Every primitive is publicly auditable.
Post-quantum signatures
NIST FIPS 204 (formerly Dilithium-87). Resistant to Shor's algorithm. Used for every atom signature, capability token, ScreenProof, and TopologicalErasureCertificate.
Post-quantum key encapsulation
NIST FIPS 203 (formerly Kyber-1024). Used for cross-tenant query sessions + observer access channels.
Crypto-agility on chain
Every signed atom carries an algorithm-epoch header. Rotations to future post-quantum primitives are first-class operations; historical atoms remain verifiable under their epoch.
Symmetric encryption
NIST FIPS 197. Encryption at rest (EFS, S3, KMS) + in transit (TLS 1.2+). Customer's KMS keys for Enterprise-tier deployments.
Independent verification
Customers + their auditors verify any erasure certificate, sanctions screen, or chain segment cryptographically without trusting us. Source at github.com/DIGITAL-FABRIC-AI/trustdb.
Implementation sourced from PQClean (public-domain reference) + AWS-LC (BSD-licensed) + OpenSSL (Apache 2.0). Full export-control analysis (TSU §740.17(b)(1) license exception) published.
Every third party who touches customer data
Per DPA §8(2)(d). Updated with 30-day advance notice on changes.
| Sub-processor | Purpose | Region | Data category |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, compute, EFS, S3, Backup, ACM, SES, Route 53 | ca-central-1, us-east-1, eu-west-1, ap-southeast-1 (customer choice) | All substrate data + operational metadata |
| Cloudflare | CDN / Pages / DDoS protection (if used for marketing) | Global edge | Public site assets only |
| Neon (Postgres) | Operational metadata (tenants, users, EULA, usage meters) | Customer-region match | Operational metadata (no compliance atoms) |
| Stripe | Billing + payment processing | US (Stripe HQ) | Billing details only (no transfer data) |
| Atlassian Statuspage | Status page (R1.7) | US | Operational uptime data only |
| PagerDuty | Incident response routing (Enterprise tier) | US/EU per customer choice | Incident metadata (no compliance data) |
| HackerOne (planned R3.4) | Bug bounty platform | US | Vulnerability reports + reporter contact |
| Plausible / Fathom | Privacy-respecting analytics (no cookies; no IP storage) | EU | Aggregate page-view counts only |
What evaluators receive
Customer security teams + procurement teams can self-serve these documents.
Auditor Compliance Brief →
11-section brief covering substrate primitives, cryptographic primitives, operational controls, regulator replay procedures, sample evidence bundle, cooperation procedure, honest gaps.
Product Overview →
30-minute evaluator brief: 30-sec pitch, 6 capabilities, deployment models, regulatory posture, pricing, integration footprint, honest gaps.
Production Deployment Guide →
Day-1 + Day-2 procedures for deploying to customer's AWS account. 15-item verification checklist + common gotchas.
Compliance Officer's Manual →
9-part operational manual for the CCO/MLRO running the substrate day-to-day.
Incident Response Playbook →
4 severity levels, 8 incident-class playbooks, breach-notification matrix per jurisdiction, Article 5(2) evidence preservation.
Bug Bounty Program →
Scope, reward tiers $50-$25K, safe-harbor language, disclosure timeline, contact channels.
All 14 customer-facing documents are at the docs site. EULA, DPA, AUP, Pricing drafts available for procurement on request.
How to report a vulnerability
responsible disclosure
safe harbor
SLAack <48h · triage <7d · fix critical <14dcommitment
rewards$50 (low) → $25,000 (critical) + bonusespaid
platformHackerOne (planned, R3.4)soon
signed disclosure · coordinated
90-day default disclosure window
Every Sev2+ incident, with post-mortem
No reportable incidents to date
Pre-revenue stage; substrate primitive shipped on 2026-05-28. This section populates with every SEV-1/SEV-2 incident going forward, with timeline, root cause, customer impact, and fix verification. See Incident Response Playbook for the procedure that generates these entries.
What we don't yet claim
These are the boundaries of our current posture. We update this list as gaps close.
- SOC 2 Type II in progress. Until first report issuance (~6 months from R3.1 kickoff), we hold continuous proof artefacts but don't claim SOC 2 Type II certification.
- FIPS 140-3 lab-engaged, not certified. 12-18 month CMVP path. Currently "lab-engaged" posture.
- MiCA CASP designation pending. Application drafted; until designation, we operate under our customers' regulatory perimeter.
- Bug bounty program private channel. Public HackerOne launch is R3.4.
- TopologicalErasureCertificate is auditable today but not yet adversarially-unforgeable. Phase 1 uses FNV-1a digest; Phase 2 wraps in post-quantum SIS / ZK-STARK.
- Entangled-crossing erasure not yet implemented.
excise_crossingreturns the entanglement map for entangled crossings; polynomial-time path is roadmap. - Customer's own KYC operation is out of scope. We validate Travel-Rule certificate signatures; we don't validate truthfulness of contents.
- MCP server in design (M1-M4 sub-project). REST API is the production surface today.
- CodeGraph sync occasionally lags same-day PRs. Operational, not material to substrate correctness.
- Cross-tenant federation not yet shipped. The most powerful AML typologies span CASPs; cross-tenant federation is R5 roadmap.