The procurement-password page
Sovereign AI governance for Australia — by architecture, not by claim
Procurement officers ask one question first: “are you really sovereign?” Most vendors answer with marketing. We answer with architecture, evidence and honest gap reporting.
Why DATAP.AI is sovereign that competitors structurally cannot match
DATAP.AI’s customer-hosted architecture provides a structural sovereignty position that SaaS-hosted alternatives are not designed to match.The runtime operates inside the customer’s own perimeter — DATAP.AI is not designed to hold customer data and does not require access keys to customer environments. Foreign legal compulsion frameworks (US CLOUD Act, FISA Section 702, EU data-access laws) require the data holder to disclose. The customer retains the role of data holder, inside their own AU-sovereign perimeter. By architecture, foreign compulsion has minimal surface to act on.
The sovereignty test matrix
Use this in your vendor sovereignty assessment. Each row maps to a defensible architectural fact or a named cert path with date.
| Sovereignty test | Status | Evidence |
|---|---|---|
| AU-incorporated entity | ✅ Pass today | DATAP.AI Pty Ltd · ABN on request · ASIC company extract available |
| AU-controlled (board, ownership, directors) | ✅ Pass today | Two AU-resident founders · 100% AU ownership · no foreign capital |
| AU-located operations | ✅ Pass today | Sydney HQ · all engineering AU-based |
| AU-cleared personnel | 🟡 In flight | NV1 baseline pursued post-pilot · Defence ISM-aligned hiring policy |
| No foreign legal compulsion path | ✅ Pass today | Customer-hosted runtime — DATAP.AI is not designed to hold customer data. CLOUD Act / FISA / EU data laws have minimal surface to act on by architecture. |
| Onshore data residency | ✅ Pass today | Customer's own AU VPC · S3 · KMS · warehouse — data is designed to remain within the customer perimeter |
| Sovereign-controlled supply chain | 🟡 Configurable | Multi-LLM router supports AU-hosted open-weights (Llama / Mistral on AU GPU compute) · Bedrock AU regions · Ollama on-prem |
| IRAP-assessed | 🟡 In flight | Assessment scheduled Q4 2026 · ISM controls already mapped · ISO 27001 Lead Implementer in flight |
| DTA Hosting Strategy alignment | ✅ Pass today | Deploys into customer's existing Hosting-Certified environment — sovereignty inherited |
What we govern — three AI types, one sovereign envelope
Cited refusals (APRA · ASIC · OAIC · OWASP) before output reaches user. Multi-LLM router with PII redaction at route time. Live: stock.datap.ai · 8 languages.
Per-decision audit trail. Point-in-time model lineage — “why was this decision allowed in October?” answered in seconds. The use case Privacy Act 2026 ADM disclosure targets.
AG2-native multi-agent runtime. OWASP Agentic Top 10 coverage. Tool-call validation, action authorisation, blast-radius limits. The 2026–27 hot zone — no AU vendor competing.
What we do NOT claim today
Procurement officers trust vendors who admit gaps. Vendors who claim everything get blacklisted on the second meeting.
- ❌ IRAP-certified — assessment scheduled Q4 2026, ISM controls already mapped
- ❌ ASD-cleared personnel — NV1 baseline pursued post-pilot
- ❌ DTA Hosting Certified — we deploy into your existing Hosting-certified environment, sovereignty inherited
- ❌ AISI-endorsed — joint-pilot conversation in flight, no endorsement yet
- ❌ Sovereign LLM — we don’t build LLMs; we let you choose your LLM sovereignty level
We are sovereign-aligned by architecture today; sovereign-certified through Q3 2027. That distinction matters and we keep it explicit.