Home / Sovereignty & Trust
Trust you can verify, not just take on faith.
Most discovery platforms ask you to connect your network to their cloud, then reassure you with certifications about that cloud. Claridis is built the opposite way: the appliance runs inside your perimeter, your operational data never leaves it, and every trust claim maps to something you can inspect on the box.
The safest place for your network data is the place it already lives.
Sovereignty here is not a region setting or an enterprise add-on. It is the architecture — a closed, node-locked appliance with no dependency on external infrastructure.
Discovery is invasive by nature: it collects the most sensitive map of your estate — addresses, credentials in use, topology, configurations. Sending that to a vendor cloud creates exactly the exposure regulated, OT and defence networks exist to avoid.
Claridis keeps all of it on an appliance you own and control. Discovery, IPAM, topology, automation and compliance all run locally — as does the AI on the Local AI edition. There is no vendor backchannel and no phone-home connection. The single, deliberate bridge to us is licensing — a signed licence file you download once and apply offline — and it never carries any of your network data.
What "sovereign by design" means.
Each of these is a property of how the appliance is built and shipped — not a policy promise.
Your data never leaves
All discovery and analysis — and, on the Local AI edition, the AI — run on the appliance inside your perimeter. There is no outbound telemetry and no vendor backchannel. Optional integrations such as syslog forwarding, remote assistance and CVE lookups are strictly opt-in and operator-controlled.
Bound to your hardware
Each appliance is licensed to its specific node. A licence issued for one machine will not run on another — the entitlement and the hardware are cryptographically tied together.
A closed, hardened build
The software is compiled for the appliance and the filesystem is hardened for a closed deployment — reducing the moving parts and the attack surface a general-purpose install would carry.
Signed and air-gap-safe
Updates arrive as RSA-signed offline packages. You verify the signature and apply them on your own schedule, with automatic rollback on failure — no internet connection required at any point.
Offline licensing & verification
Licensing uses offline RSA public-key signatures verified on the appliance itself. Entitlement, updates and backups are validated locally against keys held on the box — never by calling a licence server.
Residency you do not have to configure
Operational data stays on your appliance, in your facility — the strongest possible residency guarantee. This commercial site is hosted in Australia and holds no customer network data.
Mapped to the obligations you carry.
Claridis is designed to help you meet Australian security obligations and produce evidence for them. It supports your assessment — formal accreditation (for example an IRAP assessment) is performed by your organisation or an assessor against your own deployment.
| Framework | What it asks of you | How Claridis helps |
|---|---|---|
| ISMInformation Security Manual | System hardening, access control, event logging and controlled patching. | Hardened closed appliance, RBAC with MFA, a full authentication and change audit trail, and signed offline updates you control. |
| Essential Eight | Patch applications and operating systems, MFA, restrict admin privileges, regular backups. | Signed offline updates with rollback, MFA and account lockout, least-privilege RBAC roles, and gate-free cross-version backup and restore. |
| IRAP | Independent assessment of security controls for government data. | On-premises with no egress, Australian residency, and a local-by-default security posture self-audit that helps you assemble control evidence for an assessor. |
| PSPFProtective Security Policy Framework | Protect official information, enforce need-to-know, maintain accountability. | Sovereign on-premises deployment, organisation isolation and role-based access, and a session-grouped access trail for accountability. |
| SOCI ActSecurity of Critical Infrastructure | Understand and manage risk to critical infrastructure assets. | Evidence-based asset discovery, IPAM and topology with impact and single-point-of-failure analysis — visibility of OT estates without any external dependency. |
The controls under the claims.
Sovereignty is the architecture; these are the day-to-day controls that support it inside the appliance.
Access & identity
Role-based access across defined roles, multi-factor authentication, account lockout and trusted-device handling, with optional enterprise LDAP/AD and SSO.
Audit trail
Every authentication and change is recorded with the actor and organisation, presented as a session-grouped trail you can review and export.
Transport security
HTTPS across the appliance with an admin certificate lifecycle — import, renew and revert — and optional HSTS for the web console.
Posture self-audit
A local-by-default vulnerability and hardening self-audit. CVE lookups (NVD, plus ASD's ACSC advisories) remain disabled until an administrator enables them, and can point at a mirror you host instead of the public feed.
AI governance
On the Local AI edition, the appliance audits its own AI posture against Australian and international frameworks and produces a narrative you sign off — because the AI runs locally too.
Backup & recovery
Cross-version backup and restore and signed updates with automatic rollback, so recovery never depends on reaching an external service.