Secure Node Infrastructure Infrastructure de Nœuds Sécurisés

The Physical Infrastructure

St. Lawrence Gate's Sovereign AI operates on dedicated server hardware located in two Tier III data centres in Toronto and Calgary. These facilities are operated by Canadian companies, subject to Canadian law, and contractually prohibited from transferring client data outside of Canada under any circumstance, including requests from foreign governments or law enforcement agencies.

The Toronto and Calgary nodes operate in an active-active configuration, meaning that both facilities are processing client data simultaneously and either can assume full operational capacity within minutes if the other experiences an outage. This architecture ensures that no single point of failure can interrupt service to clients.

Encryption Architecture

Client data is encrypted at rest using AES-256 encryption with key management performed by hardware security modules located within each facility. Data in transit between the facilities and between the infrastructure and client-facing applications uses TLS 1.3 with perfect forward secrecy. Encryption keys are rotated quarterly, and the key management system maintains a complete audit log of all key operations.

Access Controls

Access to the Sovereign AI infrastructure is restricted to a defined list of St. Lawrence Gate technology team members, each of whom is subject to a comprehensive background check, security clearance, and mandatory security training. All access is subject to multi-factor authentication, all sessions are logged, and all privileged access operations are subject to four-eyes approval from a second authorized administrator.

Backup and Recovery

All client data is backed up in real time to both the Toronto and Calgary nodes, with an additional encrypted backup maintained on air-gapped storage media that is physically stored in a separate secure facility. The recovery time objective for a complete infrastructure failure is four hours; the recovery point objective is one hour of maximum data loss. These targets are tested through simulated recovery exercises conducted twice per year.