This is the first and only operational implementation we have seen of what our research describes. The market knows it needs sovereignty; the implementation gap has been widening every year. SkyeConnex is the gap-closer.BARC — Data Sovereignty 2026: Reality, Relevance, Roadmap
PIPEDA
Canadian Personal Information Protection and Electronic Documents Act. Sets encryption posture, Canadian allow-list, and 24-month retention defaults.
GDPR / UK-GDPR
EU and UK data-protection regulations. Sets encryption posture, EU allow-list, DSAR-ready audit log, signed deletion certificates.
SOC 2 Type II
Pre-configured access-control, audit-log, and continuous-monitoring evidence collection plumbing.
HIPAA-BAA
BAA-able architecture with healthcare-grade encryption, audit, breach-detection, and patient-record handling presets.
FedRAMP
US-only allow-list, IL2-IL5-amenable hosting, continuous monitoring already running in production.
DGSI 100-8
Standards Council of Canada sovereign-cloud standard series. SkyeConnex functions as a reference implementation of the Sovereign / Defence tier.
What the preset actually writes
Selecting a compliance pack is one action that cascades through four policy domains:
- Encryption policy. Algorithm class, key wrap strategy (including hybrid PQ wrap for sovereign-tier packs), per-frame IV scheme, AAD binding.
- Geo policy. Allow-list or block-list of jurisdictions for shard placement. Strict-mode hooks (fail rather than degrade) when policy cannot be satisfied.
- Retention policy. Per-class file retention, trash window, audit-log retention, certificate retention.
- Audit treatment. Event types signed by default, export format, streaming destinations.
The pack itself becomes the documentation of what was applied — an auditor can read the pack definition and reconcile it line-by-line against the framework.
Four enforcement boundaries
Once configured, compliance policy is enforced at four distinct points in the platform:
- Pre-flight — /api/account/upload-eligibility runs before the client commits to an upload; the UI proceeds or shows a deep-linked remediation banner.
- Gateway boundary — the S3 gateway re-checks eligibility before SigV4 hand-off. Eligibility is not implied by authentication.
- Mid-upload — long uploads re-check policy in flight, catching company-level changes made while the upload was in progress.
- Tier gate — a min-tier gate prevents an account from authenticating below the tier its compliance policy requires.
Failures surface as deep-linked remediation banners — the user sees what failed and one click takes them to the setting that fixes it.
Signed compliance reports
Every report SkyeConnex generates is cryptographically signed and verifiable. Four first-class reports — Sovereignty Audit, Threat Scenario, Standards / Compliance, Resilience (financial) — each dual-signed with HMAC-SHA-256 and ML-DSA-87 (FIPS 204). Auditors can verify online via /api/reports/verify or offline against the published issuer key on /security. Non-repudiation, not "trust us, the secret matches."
Eleven privacy regimes supported by default
PIPEDA (Canada), GDPR and UK-GDPR / DPA 2018 (EU and UK), CCPA / CPRA (California), HIPAA (US healthcare), APP (Australia), APPI (Japan), MAS / PDPA (Singapore), LGPD (Brazil), POPIA (South Africa), and PDPL (Middle East).
Compliance, in depth
FIPS 203 and FIPS 204 explained: what NIST's PQ standards mean for procurement
NIST finalised both post-quantum standards in August 2024. ML-KEM-1024 (FIPS 203) and ML-DSA-87 (FIPS 204). Here's what procurement teams sh…
Read → Industry · Healthcare · 9 min readHealthcare data residency: PIPEDA + HIPAA + provincial — a survival guide
Healthcare data in 2026 must satisfy PIPEDA, HIPAA, provincial health acts, and emerging AI compliance — often simultaneously. The architect…
Read → Regulation · 9 min readSchrems II two years on: what actually changed for EU-US data transfers
The 2020 CJEU ruling invalidated Privacy Shield. Five years and one EU-US Data Privacy Framework later, the underlying problem remains. Here…
Read →Compliance, in days. Not quarters.
Book a briefing. We will walk you through the pack you need and the audit-log artefacts it produces — live, on a real tenant.
Frequently asked questions
What is Compliance-as-a-Service?
Pre-configured compliance packs that bundle encryption policy, geo policy, retention policy, format standards, and audit treatment into a single selection. The pack itself becomes the documentation of what was applied — auditors can read it line-by-line against the framework.
Which frameworks are supported?
PIPEDA (Canada), GDPR + UK-GDPR / DPA 2018 (EU and UK), SOC 2 Type II, HIPAA-BAA, FedRAMP, and DGSI 100-8 (Canadian sovereign-cloud standard). Eleven privacy regimes total are supported through region-tagging and audit-log primitives.
Are reports auditor-verifiable offline?
Yes. Every signed report and integrity certificate is dual-signed with HMAC-SHA-256 (online verify) and ML-DSA-87 (FIPS 204 post-quantum). The issuer public key is published at /security; auditors can verify any signed report entirely offline with any FIPS 204 verifier — without contacting the platform.
How is policy enforced?
At four boundaries: pre-flight (before client upload), gateway boundary (re-checked at SigV4 hand-off), mid-upload (re-checked during long uploads), and tier gate (auth fails below the required tier). Failures surface as deep-linked remediation banners.