Three reinforcing layers. No single point of trust.
SkyeConnex's architecture encodes the sovereignty guarantee into the data itself — through cryptographic isolation, geometric distribution, and jurisdictional policy. Each layer is sufficient on its own. Together, the composition is unbreakable in practice.
Cryptographic isolation
Every file gets a unique data-encryption key (DEK). The DEK is wrapped by a User Master Key (UMK) that the server never holds in unwrapped form. Frame-level AES-256-GCM with deterministic per-frame IVs and AAD binding tying ciphertext to file identity.
-
CRYPTO
AES-256-GCM frame encryption
Per-frame deterministic IV bound to (file_id ‖ frame_index) prevents nonce-reuse classes of attack. AAD ties ciphertext to (file_id, frame_idx, encrypted_size) — shard substitution is detected at decrypt.
-
KEY-WRAP
AES Key Wrap + ML-KEM-1024 hybrid
The DEK is wrapped with AES-KW (SP 800-38F). On the Sovereign tier, the wrap is composed with ML-KEM-1024 (FIPS 203) for hybrid post-quantum protection. A future cryptographically relevant quantum computer must also defeat AES to read the data.
-
UMK
Zero-knowledge User Master Key
The UMK never reaches the server in unwrapped form. It is derived from the user's password (scrypt KDF) or recovery key, both of which only the user holds.
-
RECOVERY
Out-of-band recovery key & duress mode
A 24-character recovery key independently wraps the UMK so password loss does not mean data loss. A secondary duress password unwraps a limited shadow scope under coercion.
-
SPLIT
Split-Authority Decryption (Shamir Secret Sharing)
For the most sensitive scopes, an M-of-N custodian quorum is required to unlock. No single custodian can compel access.
NIST-published primitives only.
Every primitive in active use is NIST-published. No proprietary algorithms — a deliberate choice that compresses the FIPS 140-3, Common Criteria, and FedRAMP certification path from years to months.
Geometric distribution
Every file is split into ~5 MB frames. Each frame is independently Reed-Solomon encoded RS(5,2) into seven shards: five data shards and two parity shards. Each shard goes to a different provider from your connexion set. Loss or compromise of any two leaves the data fully reconstructable.
5 data + 2 parity shards
Reed-Solomon RS(5,2) per frame. Tolerates loss of any two of seven providers without data loss — and reveals nothing readable when one is compromised.
Idempotent upload keys
Per-shard upload keys make scatter retryable without duplication. Failed provider writes recover without re-encrypting the source.
Per-shard SHA-256 integrity
Every shard carries a SHA-256 hash for bit-rot detection. Read paths walk all seven shards in parallel and return as soon as any five succeed.
Jurisdictional policy
Every provider connexion is region-tagged — auto-detected from the provider's API or explicitly set by the operator. The platform enforces an account-wide geo-fencing policy at upload time, with confidence-graded endpoint resolution surfacing across every sovereignty view.
-
ALLOW
Allow-list mode
Only listed jurisdictions accept new shards. Outside-policy providers are excluded from scatter.
-
BLOCK
Block-list mode
Named jurisdictions are excluded from scatter. All other providers are eligible.
-
STRICT
Strict-mode hooks
Fail the upload rather than degrade silently when policy cannot be satisfied. Compliance integrity over availability.
-
CASCADE
Effective-policy cascade
Company beats per-account, reseller beats company. The resolver returns (value, source) tuples — every setting in the UI shows where it came from.
-
ACK
Sovereign acknowledgment workflow
Attaching a sovereign-class connexion (on-prem MinIO, customer VPC) requires explicit operator acknowledgment — captured with timestamp and identity as a compliance-audit artefact.
Sovereignty, on screen, in real time.
SkyeMap is the live sovereignty surface: account-wide score, per-jurisdiction roll-up across PIPEDA, GDPR, UK-GDPR, SOC2, FedRAMP, APP, APPI, MAS, LGPD, POPIA, PDPL, per-folder breakdown, per-file drill-down showing which jurisdictions hold its seven shards.
Confidence-graded endpoint resolution
Every provider endpoint on the SkyeMap is resolved through a confidence-ranked hierarchy: Probed → Declared → Observed → Country-only → Unknown. Each renders with a distinct pin colour so evidence and claims are visually distinct — making sovereignty operationally enforceable, not aspirational.
Threat Simulator
Click-to-block any country and the platform recomputes shards lost, files at risk, files unrecoverable, and the sovereignty-score delta in real time. RS(5,2)-aware: a file is only marked unrecoverable when at least three of seven shards land in blocked countries. Preset scenarios: Five Eyes, CLOUD Act bloc, China, Russia.
Memory-flat. Resumable. Async by default.
Frames are encrypted with AES-256-GCM as they ingest — never accumulated in plaintext, never held in memory beyond a single ~5 MB chunk. Async scatter returns the HTTP 202 the moment raw bytes hit tmpfs staging; the encode-encrypt-RS-scatter pipeline runs as a Celery task.
Five-endpoint chunked upload
Init · Put · Status · Complete · Cancel. An interrupted upload resumes by re-PUTting only the missing chunks. Server-side staging TTL is 24 hours.
Multipart over the same pipeline
S3 multipart PUTs from third-party SDKs reframe behind the gateway and join the same encrypt-encode-scatter path as native uploads. One canonical integrity model.
HA via Redis-backed primitives
Leader locks, frame-level work queues, shard-distribution barriers. The same binary runs on a laptop and on a five-node cluster.
The architecture is the proof.
Book a briefing. Live walkthrough of CloudRAID, the SkyeMap, the Threat Simulator, and a signed-report verification.