the sovereign data vault · 2026-09-08
What a Fortune 500 buyer actually procures when they buy a data-driven service, and why the work between the components is the product.
An organisation that holds valuable data and wants to sell data-driven services to Fortune 500 clients faces a reasonable-sounding shortcut: buy a graph database, add an LLM observability suite for tracing and evaluation, and build the rest in-house. It is worth being precise about what that shortcut buys, because the gap between it and a contract-ready service is where first-time launches fail.
A Fortune 500 buyer does not procure a database with AI on top. They procure a defensible answer to five questions their security and privacy reviewers will ask. Whose authority did that query run under? What left the building, and was it de-identified first? Can you reconstruct what you knew as of a given date? Who decided, and is that decision on a ledger nobody can rewrite? Is our data isolated from your other customers, on infrastructure we can point to? A database engine and an observability suite are components. Neither answers those questions. The work between them does, and that work is the product.
Consider what each question costs on the do-it-yourself path. Authority: a database gives you permission clauses to author, per table and per field, and then to prove; observability tooling gives you traces of model calls, which say nothing about the data plane. SentryVault runs every data operation as the caller's own identity, never as the system itself, against a deny-by-default identity plane. A query that a role may not make returns nothing rather than something, and the engine refuses to run at all without a caller's token.
Scope: with a database, a workflow can do whatever its connection can do. In SentryVault, the only outward data surface is a small catalogue of named, scoped capabilities. A workflow cannot write a field that is absent from its capability's allow-list; the conclusion field is simply not there. Governance is structural, not textual, and it holds whether or not anyone remembers to enforce it.
De-identification: an observability suite records what was sent to a model. SentryVault masks eight categories of personal information before anything is cached and before any model is called, and a redaction service that cannot be reached stops the workflow. Raw text is never forwarded on the assumption that it was clean.
Decision and custody: rows and traces record that something happened. SentryVault records who decided, with the human gate's authority written by the engine itself rather than read from a document that could claim it. Every action lands on an append-only ledger indexed by actor, time, event and target, with before and after states, retained for the term of the engagement plus seven years. Because the data model is bitemporal, reconstructing what was known as of a date is a query, not a forensic exercise.
Isolation and residence: SentryVault is deployed one organisation per appliance, on dedicated Canadian infrastructure operated by IAXOV or on infrastructure the client owns. The data plane accepts no inbound connection. Administration rides a named, time-bound sovereign channel. Which AI providers are used is configurable per deployment and is never disclosed to the client outside a formal audit, so a vendor's name can never become a reason to trust or distrust an answer.
The part first-time launchers underestimate is not the first demonstration. It is the third security questionnaire, from a buyer whose procurement office has already declined two vendors this year for putting AI on their data. SentryVault front-loads that conversation into artefacts that exist on day one: a privacy and security policy with a control trace to SOC 2, ISO 27001 and ISO 42001, aligned by design and never claimed as certified in advance of certification; a deployment checklist; and a suite of fifteen gates whose job is to make the controls refuse, run on the buyer's own data model, in front of them. The suite refuses to report a gate that asserted nothing, and every control carries a recorded red result as well as a green one. The do-it-yourself path produces these artefacts eventually, after each is demanded. SentryVault ships them.
The evidence for the substrate comes from reference builds, not from client deployments, and the distinction matters. The substrate is generated from design data, so its totals, floors and guards are derived rather than typed and regenerate their own proofs when the model changes. To show that the generators, the engine and the gates are independent of any one domain, two unrelated reference verticals are maintained for training and demonstration, on synthetic data: a 220-table parts-manufacturing model and a 43-table crop-traceability model, built by the same generators, running on the same engine and passing the same fifteen gates. The manufacturing reference build alone carries 267 permission clauses and 543 role checks. Those figures describe the training edition of the substrate. A client's deployment starts from the same generators and produces its own counts and its own gate run, on the client's model, and that run is the thing a buyer can watch.
Product deployments are a separate matter, and within them delivered, verified and roadmap are kept distinct. Delivered and verified: the training edition of the substrate described above, available to accredited institutions for coursework; and a sealed Freedom-of-Information appliance, deployed as a product on IAXOV-operated infrastructure, with live demonstrations for government records requests, non-profit privacy requests and healthcare privacy requests available under NDA. Built and self-tested: the pull-only planes of the sealed appliance, namely a signed configuration plane, a trigger plane, an authority layer that proves a caller's right to invoke an operation, and a process-plane executor that runs named, scoped operations without exposing a query surface. Scoped with each engagement rather than claimed in advance: the client's own catalogue of governed operations, a channel broker in the client's trusted zone, the end-to-end sealed deployment on the client's host, on-box GPU inference, and production connectors to the client's systems. Third-party certification is an available option; the controls are operated to the aligned standard today.
For an organisation without a launch track record, the cost of the do-it-yourself route is not the licence fees it saves. It is the interval between "it runs" and "a Fortune 500 security office signed it off", and the reputational cost of the questionnaire that exposes the gap. SentryVault collapses that interval to configuration: your data model as a signed bundle, your governance as declared roles and capabilities, your proof as a gate run the buyer can watch. The practical next step is a briefing under NDA with a live demonstration over synthetic data, followed by a paid proof of value on a bounded dataset of your own.