The sovereign supply chain for
Canada's classified Kubernetes.
A Canadian-jurisdictional trust path from build to apply, for cleared engineering teams bringing Kubernetes to Protected B and Secret environments. Signed with your keys. Verified by your engineers, offline.
One trust path. Built for what Canada must build.
A deploy-time substrate for classified Kubernetes. Artifacts are bundled, signed, verified, and audited on the customer's infrastructure, under the customer's keys.
- 01
A Canadian-jurisdictional trust path
Every artifact bound for a classified Kubernetes cluster bundled, signed, attested, and applied under Canadian jurisdiction. The vendor is Canadian-incorporated and the supply chain is Canadian-jurisdictional. Artifacts are signed with the customer's keys and verified offline against the customer's own trust root. No remote service sits in the verification path, foreign or otherwise.
- 02
Hardened artifact attestation
Every artifact entering a classified cluster is signed, attested, and accompanied by a software bill of materials. Inspectable end to end. Auditable by your own people, without Northfleet.
- 03
Air-gap operations
A productized one-way transfer protocol with attestation chain and tamper-evident audit trail. Designed for SCIFs where the high-side machine has never seen the internet, and never will.
- 04
Accreditable compliance and audit
Controls from ITSP.10.033, the catalogue that replaced ITSG-33 in 2026, mapped to Northfleet's capabilities. Auditor-ready evidence collection built in, and required in Protected B mode. Every signature, attestation, and audit entry is produced on the customer's infrastructure and verifiable on the customer's terms, without Northfleet in the loop.
The sovereignty requirement is now a procurement requirement.
Canada's Defence Industrial Strategy committed the country to a domestic defence industrial base, with explicit procurement preference for Canadian-controlled infrastructure. The DSRB is now headquartered in Canada. BDC's Defence Platform is deploying capital to operators that can hold the jurisdiction line.
Every meaningful Kubernetes platform in production at Canadian defence primes today has a foreign-jurisdictional supply chain governing what enters it. The sovereign supply chain into those platforms is the part this strategy still has to buy.
Buyers operating where jurisdiction matters.
Defence primes
Engineering and accreditation teams running classified Kubernetes for federal customers under domestic-controlled procurement.
Federal departments
CIO and CTO offices building Protected B and Secret capability inside Canadian boundaries, on Canadian-operated infrastructure.
Allied multilateral buyers
DSRB-aligned partners standing up sovereign-by-default infrastructure for cross-jurisdictional defence programs.
Sovereignty is the substrate, not the slogan.
- ·
Supplied by a Canadian-incorporated vendor with a Canadian-jurisdictional supply chain.
- ·
Deployed on Canadian-jurisdictional infrastructure by cleared engineering teams.
- ·
Built on upstream Kubernetes. No fork. No lock-in.
- ·
Inspectable from artifact to apply. Audit is built in, not an add-on.
- ·
Designed for accreditation from the first commit, and mapped control by control to ITSP.10.033.
Ship classified workloads
on Canadian terms.
Northfleet is built for defence primes, federal departments, and allied buyers running classified workloads on Canadian-jurisdictional infrastructure. A briefing follows first contact.