The technical brief,
on request.
Sovereignty is a question of jurisdiction, not hosting. The Northfleet architecture brief covers the sovereign supply chain at the depth a defence-prime engineering team or federal accreditation authority will expect: protocol, attestation chain, threat model, and accreditation mapping. It is not a public document.
At engineering depth.
- 01
Protocol design and attestation chain
How artifacts move from build environment to classified deployment without a back-channel: the bundle protocol, signature flow, verification path, and apply pipeline, including the offline check an accreditor can run with widely available tooling and no Northfleet software.
- 02
Threat model
What Northfleet defends against, and what it deliberately does not. Trust boundaries, the threats in scope with their defences and residual risk, and the threats deliberately left out of scope.
- 03
Cryptographic posture
The approved algorithm set and how verification enforces it, the FIPS 140-3 posture, and post-quantum migration. Current release binaries run their signing, signature verification, and hashing in a CMVP-validated module (the Go Cryptographic Module, certificate #5247) in FIPS 140-3 mode; the brief sets out which platforms that covers and what runs outside the module.
- 04
Accreditation mapping
Control-by-control coverage of the Cyber Centre's ITSP.10.033-01 Medium profile: what the tooling implements, what it implements in part, what the deploying organization's environment carries, and the selected controls the mapping does not address.
- 05
Operational topology
The operating model: the two zones the customer operates, the deployment surfaces (on premises, sovereign cloud, hybrid) and the criteria a sovereign-cloud region must meet, and the responsibility split between Northfleet (vendor) and the customer (operator).
- 06
Engagement
What a program receives at procurement, how Northfleet compares with the existing air-gap tools, the audit-log and OSCAL evidence formats, and how support and security disclosure work.
Written for the people who will accredit it.
The brief is intended for engineering directors, principal and staff engineers, security architects, and accreditation authorities at Canadian defence primes, federal departments, and allied multilateral buyers.
It assumes operational familiarity with Kubernetes, classified deployment environments, and the Cyber Centre's control framework (ITSG-33 and its ITSP.10.033 successor). It is not a marketing document and does not pretend to be one.
Request access.
If you are an engineering or accreditation lead at a Canadian defence prime, a federal department, or a DSRB-aligned partner, the full brief is yours to request. Fill in the form below and we will follow up within two business days.
Have the full brief sent to you.
Tell us who you are and where you sit. We respond within two business days, and the brief follows once we have spoken.