Sovereign by construction.

tenant_id is a first-class, verified request concern resolved once at the edge and carried through every request and every stored byte. Cross-tenant reads return zero rows — no row, metric, audit entry or cached value leaks across tenants, and it is verified by an automated pen test in CI.

Every audited action is appended to a hash chain; each entry carries time, tenant, actor, action and resource and is signed with Vault Transit. Because each hash links the previous, any tampering breaks the chain. Entries are tenant-scoped and retained 7 years.

API tokens, R2 access-key secrets and engine DSNs are Vault-backed; the raw credential never leaves Vault and is referenced by secret_ref. Cloud KMS is forbidden by invariant — key custody stays sovereign.

Because the object store and the CDN are the same platform, bytes served bucket→edge are classified intra-edge and zero-rated. There is no cross-vendor boundary to leak data or bill egress across — the economics and the data path are both sovereign.

An edge WAF at gateway parity with DDoS scrubbing at the PoPs; ZTNA access is default-deny with per-request grant evaluation and a recorded session verdict. Containment (SS-28) is proposed → approved → executed — guard-railed, never automatic.

Per-class residency rules are set, validated and audited on the network fabric, and buckets carry a region. Data stays in its residency zone as a governed property with an audit trail — not a best-effort setting.