Govern in place is a shorter sale than migrate first
Sovereign-capable is not the same as isolationist. The platform is designed to run with nothing, and to be a good citizen of everything you already own: federate your identity provider, resolve secrets from your vault, wrap your key manager, catalog your warehouse without moving it, feed your detection stack, and expose the whole thing to your assistants over an open agent protocol.
Every row below is a surface that exists. None of them is a certification, a validation or a partnership, and we do not describe them as one.
Server, we expose itClient, we connect to itBothEmbeddedGenerator
Breadth at a glance, with the direction on it
Every figure below is measured and quoted the same way across the site, a served surface is one we expose, a consumed surface is one we connect to. The rows that follow this matrix name each interface individually.
| Surface | Measured | Served | Consumed |
|---|---|---|---|
| Query engines, one policy plane | 8 engine types under one data-security plane | PostgreSQL wire, Arrow Flight SQL, Redis protocol, SQL, Gremlin, GQL / Cypher, KQL, PromQL | — |
| Redis-protocol structures | 34 data-structure types over the Redis protocol | A native RESP2 / RESP3 server over the structure engine | — |
| Streaming connectors | 106 stream connectors | — | Kafka, change capture, cloud messaging and more, behind an egress guard |
| Open-format table sharing | 3 sharing mechanisms | Delta Sharing, Iceberg REST catalog | Delta Sharing as a client |
| Certificate systems | 3 certificate systems at operational parity | X.509, SSH and PGP, issue, sign, verify, revoke, rotate | — |
| PKI protocol servers | 5 PKI protocol servers | OCSP, CRL, SSH KRL, SPIFFE workload API, KMIP | — |
| Detection connectors | 8 SIEM inbound connector types | 3 forwarding destinations | Splunk, CrowdStrike, Microsoft Sentinel, STIX/TAXII, syslog and more |
| External key management | 4 external key-management bridges | — | AWS KMS, Azure Key Vault, GCP KMS, Vault transit, and a bring-your-own-key registry |
| Secrets backends | 5 secrets backends | — | Local, AWS Secrets Manager and Parameter Store, Azure Key Vault, GCP Secret Manager |
| Estate export | 4 infrastructure-as-code export formats | Terraform, CloudFormation, Bicep, ARM, rendered from inventory, no cloud credentials | — |
| Tactical and mission | 24 tactical and mission protocol parsers | — | Situational-awareness, maritime, aviation, space, sensor, radio and spectrum formats |
106 stream connectors: Quote the connector catalog as a catalog. An open finding records connectors that report running with no transport; verify any individual connector before demoing it.
34 data-structure types over the Redis protocol: Thirty-three are customer-visible; one (`__memttl__`) is internal bookkeeping. Pair the 34 with the 33-customer-visible note wherever the reachable surface is what is meant.
3 certificate systems at operational parity: Say "operational parity", never "feature parity".
5 PKI protocol servers: ACME, EST and SCEP are deliberately excluded. They are fail-closed scaffolds and serve in no configuration.
Data and query
Your analysts keep their tools. A credential resolves to a real directory entity with real grants, and the data-security plane is on the wire path, not beside it.
| Interface | Direction | Notes |
|---|---|---|
| PostgreSQL wire protocol | Server | psql, DBeaver, any Postgres client. Credential auth resolving to a directory entity, workspace scoping, data-security guards. |
| Arrow Flight SQL | Server | High-throughput columnar pulls over gRPC/Arrow, proven against a stock Arrow Flight SQL client. One endpoint per live cell for multi-cell fan-out; the data-security plane masks columns on the served stream. Bring a standard client, no BI tool is certified. |
| RESP2 / RESP3 (Redis protocol) | Server | A native TCP server over the structure engine. Deny-by-default until the connection authenticates. |
| SQL | Server | Across transactional and analytical engines, with cross-database federation. |
| Gremlin | Server | Graph traversal. |
| GQL / Cypher | Server | Property-graph query with distributed traversal and algorithms. |
| GraphQL | Server | Merged domain schema with subscriptions and query cost analysis. |
| KQL | Server | Tokenizer, parser, function registry and translator. |
| PromQL | Server | Parser and engine including rate, increase and histogram quantiles. |
| Streaming SQL and complex event processing | Server | Windows, watermarks, temporal joins, pattern matching, emit semantics. |
| Iceberg REST catalog | Server | Table registration and metadata publishing for external readers. |
| Delta Sharing protocol | Both | Open cross-organization sharing, as server and as client. |
| OpenMetadata-compatible REST | Server | Tables, topics, databases, tags, glossary terms, lineage to depth five, full-text search. |
Storage and files
All behind one shared namespace guard, deny-by-default. Operations we do not enforce are refused rather than accepted and ignored.
| Interface | Direction | Notes |
|---|---|---|
| S3 (SigV4) | Server | Object and multipart surface, tagging with namespace-scoped search, keyset pagination for stable iteration over changing datasets. |
| WebHDFS | Server | — |
| SFTP | Server | Through the node gateway, scoped to a workspace. |
| Native object REST and gRPC | Server | — |
| Object change streams | Server | A native subscription delivering write events. |
Messaging and events
A message carries the same classification, workspace scope and audit trail as a table.
| Interface | Direction | Notes |
|---|---|---|
| Native publish/subscribe (HTTP and gRPC) | Server | Subjects, consumer groups, durable cursors, transactions with producer fencing. |
| MQTT 5.0 | Server | A bridge with a documented mapping: topic to subject, quality-of-service to delivery semantics, retained to retention policy, will to scheduled delivery. |
| AMQP | Server | Bridge. |
| Kafka, server-sent events, WebSocket, webhook, syslog, database change capture, file watch | Client | Among the built-in connector catalog. |
| Cloud messaging (major providers) | Client | Queue, topic, stream and event-bus services, with producers created behind an egress guard. |
| PGP message transport | Both | End-to-end encrypted envelopes with recipient and sender selection policy. |
| Disruption-tolerant bundles and offline transfer | Both | For contested and absent links, with custody transfer and contact-graph routing. |
Identity, security and PKI
Federate with what you already run. Your joiner-mover-leaver process stays; agents and devices land in the same directory as the federated humans.
| Interface | Direction | Notes |
|---|---|---|
| SAML 2.0, OIDC, LDAP | Both | Provider aggregates with a registry and connection testing, metadata generation, signature verification and a replay store. |
| SCIM | Server | Bearer auth, filter parsing, schema conformance and a background sync worker for user and group provisioning. |
| Smartcard authentication | Server | Common Access Card and Personal Identity Verification. |
| WebAuthn, TOTP | Server | — |
| ACME (RFC 8555), EST, SCEP | Both | Certificate enrollment scaffolds. These are fail-closed and do not issue in any configuration today, listed for completeness, not as a capability. |
| OCSP, CRL, SSH KRL | Server | Revocation. |
| SPIFFE workload API | Server | X.509 and JWT identity documents. |
| KMIP | Server | External clients create, get and destroy keys over the standard protocol. |
| TPM 2.0, PKCS#11, hardware tokens | Client | Key storage and attestation, signing without exporting. |
| External key management (major cloud KMS and vault services) | Client | With a bring-your-own-key registry, or stay entirely in-platform on hardware. |
| OCSF | Both | Open security event schema, our own events arrive already normalised. |
| STIX / TAXII | Client | Threat intelligence. |
| Sigma | Client | Detection rules evaluated as continuous streaming queries. |
| C2PA | Server | Content-provenance verification on inbound captures. Signing of outbound content is not offered. |
AI and interoperability
Reachable by other people's agents, under your governance, and able to reach theirs, under your policy.
| Interface | Direction | Notes |
|---|---|---|
| Model Context Protocol | Server | Measured agent tools with token and OAuth authentication, schema validation and a path-segment validator that rejects traversal. |
| Agent-to-agent cards and key endpoint | Both | Discovery at the standard well-known path, detached signatures over canonicalised cards, task lifecycle, signed push webhooks, and outbound delegation with the counterparty's card pinned on first use. |
| Hosted model providers | Client | Behind a secure provider that enforces classification policy and redacts before anything leaves the cell. |
| Local model runtimes | Embedded | No vendor egress. On by default in the shipped edge binary. |
| Major BI platforms | Generator | Native artifact generation and adapters, including semantic-model import and deployment. |
| Semantic model formats | Both | Parsed and serialised through a canonical intermediate representation, with linting and best-practice analysis. |
Observability and estate
| Interface | Direction | Notes |
|---|---|---|
| OTLP | Both | Export and receive. |
| Prometheus | Server | Scrape-compatible surface. |
| W3C Trace Context | Both | Propagated through messaging spans. |
| OpenLineage, Apache Atlas | Both | Lineage emitted and imported, so we interoperate with your existing lineage tooling instead of replacing it. |
| Terraform, CloudFormation, Bicep, ARM | Generator | Estate export rendered from inventory, with no cloud credentials involved. |
Industrial, tactical and vertical
The protocols that decide whether a platform can reach the plant, the vessel or the field at all.
| Interface | Direction | Notes |
|---|---|---|
| Industrial and control | Client | OPC-UA · MTConnect · Modbus · DNP3 · IEC 61850 · BACnet · PROFINET · EtherCAT · CAN bus · historian and controller integrations · seismic and drilling formats. |
| Tactical and mission | Client | Situational-awareness and data-link formats, drone telemetry, maritime and aviation tracking, motion imagery metadata, geospatial imagery, network capture, space packets, sonar and chemical-radiological sensing. |
| Healthcare | Client | FHIR · HL7 v2 over MLLP · DICOM · device interoperability · clinical documents · healthcare EDI. |
| Finance and commerce | Client | FIX · ISO 20022 · SWIFT · EDI · RFID. |
| Media and education | Client | Ad-insertion markers, video networking, streaming formats, student data and learning interoperability standards. |
| ActivityPub / ActivityStreams / WebFinger | Both | Governed cross-organization publishing with actor discovery and signature verification. |