Flagship · Data Privacy

Sovereignty Engine: Data Residency Tracking & Proof

Where is your data right now, where has it been, and can you prove it never left the jurisdiction?

100+Data centres mapped
6Provider types
3Levels: country, state, DC
1Single .exe, no install

Clouds Scale. Borders Don’t.

Cloud applications grow on their own. A busy afternoon starts servers in the nearest region with capacity, a disaster-recovery plan fails a region over to a neighbouring country, a backup job drops a snapshot into a default bucket abroad, and a CDN caches personal data at edges on three continents. Conventional monitoring sees the application; it does not see where each record went.

India’s Digital Personal Data Protection Act, 2023, the EU GDPR, Singapore’s PDPA, state data-centre policies and client contracts all ask one question: can you prove the data stayed where it was supposed to? Sovereignty Engine answers it, down to the individual data node, data centre and Indian state.

Sovereignty Engine command map showing a breach Fig 1: Command map during a simulated breach: nodes spilled to Singapore, Dubai, London and Virginia.

How the Engine Works

Five steps run continuously for every tagged node. Each step writes to the same tamper-evident audit chain.

1. Tag

Each record set, payload or file chunk receives a unique SHA-256-derived node ID.

2. Trace

Every hop is logged with source, destination, distance and estimated latency.

3. Compare

Locations are checked against the active policy at country, state or data-centre level.

4. Enforce

In enforce mode, out-of-jurisdiction transfers and VM spin-ups are refused.

5. Prove

A SHA-256 hash chain makes any edit to history detectable; evidence exports in JSON or CSV.

India view with cross-state transfers Fig 2: India view: cross-state replicas (amber) and cross-border breaches (red).

Country, State and Data-Centre Precision

The catalogue covers AWS, Azure, Google Cloud and Oracle regions worldwide, plus Indian State Data Centres (Telangana, Andhra Pradesh, Odisha, Uttar Pradesh) and colocation hubs, each tagged with city, state and country.

  • Path classification: every transfer is intra-state, cross-state or cross-border
  • Built-in policies: India (DPDP), Telangana state residency, EU (GDPR), Singapore (PDPA), US
  • Custom policies: approve any mix of countries, Indian states or individual data centres

Detect, Contain, Prevent

Six Real-World Scenarios

Traffic spike, DR failover, misconfigured backup, CDN edge caching, vendor transfer and inter-state replication.

One-Click Containment

Repatriates every out-of-policy node to the nearest approved region and records time-to-contain.

Enforce Mode

Blocks the transfer before it happens; blocked attempts are drawn as dashed blue arcs and logged.

Live Scorecard

Compliance %, nodes inside/outside, countries and states in use, breaches and average containment time.

Enforce mode blocking transfers Fig 3: Enforce mode: a failover and a backup to foreign regions are blocked; compliance stays at 100%.

Reading the Signals

Every transmission appears in the live feed with its route, path class, distance, estimated latency and size. Summary panels break data volume down by country and provider, and count transfers by path.

Transmission feed and analytics panels Fig 4: Scenario panel, live transmissions, and volume-by-country / path / provider analytics.
Cloud storage monitoring Fig 5: Live S3 monitoring with a lab spill to Singapore.

Real Cloud Storage: Amazon S3 Connector

Version 2.1 connects to live cloud storage with a read-only key. Every bucket is located and checked against the policy, every object receives an se-node-id tag that travels with it on copy and replication, and the same identity appearing in another bucket is recorded as a copy or a move.

  • Bucket fill levels: usage against the allocation you plan, with a warning before overflow pushes data into the wrong region
  • Replication rules: cross-border rules are flagged before any data has moved
  • Test Lab: real buckets in Mumbai, Hyderabad and Singapore with synthetic records that overflow region to region
  • Legitimacy report & notice: printable findings with legal basis and a ready-to-send notice email

Proof an Auditor Can Check

Replay any node's lineage, verify the hash chain, and hand over a printable legitimacy report.

Node lineage view Fig 6: Node lineage replayed on the map.
Audit chain verification Fig 7: A verified, hash-chained audit trail.
Legitimacy report Fig 8: Data residency & legitimacy report.
Integrations and API Fig 9: REST API, agent ingest and custom policies.

Project Snapshot

StatusVersion 2.1 released as a self-contained Windows executable (x64 and ARM64); Linux and macOS builds available. Live Amazon S3 and MinIO / S3-compatible connectors; Azure Blob and Google Cloud Storage next.
ArchitectureGo backend with embedded web console; REST API, Server-Sent Events stream, append-only hash-chained log. No database, no installer.
SecurityLocal sign-in (PBKDF2-SHA256, lockout), API keys for agents, loopback-only by default, strict Content-Security-Policy.
Who it is forGovernment agencies verifying national data is not routed offshore; enterprises meeting DPDP or GDPR while scaling; compliance firms auditing several clients.

Installation & Demonstration Guide

1. Download & Run

  1. Download SovereigntyEngine-windows-amd64.exe from the repository’s Releases page.
  2. Double-click it; your browser opens http://127.0.0.1:8787/.
  3. First run: create the administrator account.
  4. Keep the console window open while you work.

2. Demonstrate a Breach

  1. On the Command map, press Traffic spike or CDN edge caching.
  2. Press Contain breach now; the score returns to 100%.
  3. Switch to Enforce and run DR failover: the transfers are blocked.
  4. Open Audit & reports → Verify chain.

3. Connect Amazon S3

  1. Create an IAM user with the read-only policy shown in the app.
  2. Cloud storage → provider Amazon S3 → paste the key → Test connection.
  3. Optional: create a Test Lab and watch data overflow Mumbai → Hyderabad → Singapore.
  4. Open the legitimacy report.

4. Connect a Real Agent

curl -X POST http://127.0.0.1:8787/api/v1/ingest \
  -H "X-API-Key: $SE_KEY" -H "Content-Type: application/json" \
  -d '{"node_id":"PAY-000123","region":"aws:ap-south-1"}'

Try It Yourself

Run the project live in your browser, or install the open-source build on your own machine.

Live demo

Run it in your browser

The real Sovereignty Engine runs in this tab as WebAssembly: tag data nodes, trigger breach scenarios, contain them, switch to Enforce and verify the hash-chained audit trail. You are signed in automatically.

RUN DEMO

Live-network scanning and cloud-storage connections need the installed app; the simulation, policies and audit run fully in the demo.

Open source

Install it on your machine

Download the single executable for Windows, Linux or macOS to scan this computer’s live connections and connect your Amazon S3 or MinIO storage.

INSTALL THE PROJECT (OPEN SOURCE) Source code on GitHub

Download & Explore the Source Code

The Windows executable, Linux and macOS builds, and the complete source with API documentation and the AWS S3 setup guide.

Download for Windows Visit Repository