Abstract
Storage never implies access.
sovm replicates a dataset across machines under a single trust authority and keeps it encrypted so that the machines carrying it cannot read it — and neither can any third party. Its preferred live transport substrate, iroh, finds peers by public-key identity, traverses NATs where possible and falls back to encrypted relays. Privacy is not a feature here; it is the constraint the rest of the design bends around.
- Status
- Specification. No released implementation.
- SOP/1
- Frozen architecture baseline, ten open decision gates.
- SSP/1
- New specification, conformance corpus pending.
- Transport
- iroh over QUIC; NAT traversal and encrypted relay fallback.
- Primitives
- MLS (RFC 9420), COSE (RFC 9052), Parquet.
1. Readers of this document
1.1 For investors
The binding constraint on the most valuable remaining data is governance, not capability.
- The easily-reachable training corpus is largely spent
- What remains is private behavioural, sensor and access data from humans and agents
- Continuously generated histories are newly valuable when their owners can retain custody
1.2 For enterprise architects
Replicas are only affordable if they can be cheap and untrusted.
- Gateway nodes collect while disconnected; no master node, no global sequence
- One explicit, auditable export boundary — never transparent background replication
- Revocation is an MLS membership operation with a defined cryptographic effect
1.3 For the privacy-minded
There is no vendor-held recovery key to subpoena.
- Per-object encryption; encrypted footers hide schema, statistics and row counts
- Opaque identifiers on the wire; object identity is the hash of its ciphertext
- One authority holds the keys — and it can be a person or a household
2. The problem it solves
Any dataset that must outlive one machine needs replicas. Most systems make you choose between cheap replicas and safe ones.
Replicas are only affordable if they can be cheap and untrusted, and they are only safe if holding the bytes conveys no ability to read them. sovm separates “who stores this” from “who can read this”, and neither set is inferred from the other.
Under the hood it is two protocols sharing one substrate. SSP/1 synchronizes small mutable state — configuration, catalog metadata, entity records — and supplies identity, trust and policy. SOP/1 carries high-volume data as encrypted immutable objects.
Ciphertext is the object
Encrypted Parquet with encrypted footers, so a holder learns neither contents nor schema, column statistics or row counts. Plaintext exists only as transient state on an authorized machine.
Storing is not reading
A machine can hold a complete replica while being cryptographically unable to decrypt any of it. Untrusted storage is a first-class participant.
Standard cryptography
Group membership and key distribution use MLS (RFC 9420); records and signatures use COSE (RFC 9052). Nothing bespoke to audit.
No coordination for writes
Machines produce data while disconnected and publish on reconnect. No master node, no global sequence number, no agreement between peers on the write path.
The transport finds the path
iroh dials by public-key endpoint identity, tries direct QUIC paths, hole-punches through NATs where possible and falls back to encrypted relays when direct connectivity fails.
3. Why this matters for AI
Compute goes to the data rather than the data to the compute.
The valuable remaining corpus is private, continuously generated and siloed: behavioural traces, sensor observations, access histories and decisions made by humans and agents. Nobody hands it over, because using it currently means surrendering custody of it.
To be clear about the boundary: sovm does not make a model private. It provides no differential privacy and no secure aggregation, and a node that trains must decrypt.
No export step
SOP objects are encrypted Parquet — once decrypted by an authorized node they feed Arrow, polars, DuckDB and standard loaders directly, column pruning intact. No duplicate “ML copy” for governance to lose track of.
Reproducible by construction
An object’s identifier is the hash of its exact encrypted bytes. A training run pins its input set by hash; a later run can prove it used the same data.
Verifiable provenance
Every object carries an immutable producer signature — “this came from that node” is cryptographic, not a database field somebody could have edited.
Selective access
The encrypted catalog carries time ranges and value bounds, so a training set is selected on those and only matching objects are decrypted.
Federated training is the natural shape
Scope and placement are already separate, and an aggregator can carry traffic it cannot read.
4. Two worked use cases
4.1 Personal
A private data lake with one reader: you.
Imagine holding the file Google keeps on you, joined to the file Meta keeps on you, joined to everything neither of them has: your messages, location, health, finances, reading, device access and the decisions your agents make on your behalf. Now answer the only question that matters — where would you dare to put it?
Not in a bucket you rent. Not behind a provider’s recovery key. sovm’s answer is that the lake replicates across your own machines, and any capacity you rent holds ciphertext it cannot read. Local-first by construction; hyperscalers optional and blind. A subpoena served on a storage host produces encrypted objects and nothing to decrypt them with, and the CLOUD Act reaches provider-held data, not keys the provider never had.
The point of assembling it is that an assistant can finally reason over the whole record. The model comes to the data, on hardware you control, instead of the data being surrendered to whoever is running the model.
The honest boundary
One authority holds the keys, and that authority can be a person or a household. Lose the key material and the backups, and the lake is gone — see 6.
4.2 Enterprise
A data plane laid over the network you already have.
Large organizations do not have one network; they have decades of them, plus acquisitions, plus regions that legally cannot pool their data. sovm is an overlay: it does not ask for a flat network, a central cluster or a migration. Its preferred iroh substrate finds peers across NATs, uses direct paths where possible and relay-assisted paths where necessary. Nodes replicate encrypted objects across whatever connectivity exists, including links that are metered, intermittent or one-way.
The shortest description is a child of Tailscale and Databricks — the former’s “connect the estate without re-architecting it”, the latter’s “tables and files people can actually query”. Objects are encrypted Parquet, so once an authorized node decrypts, DuckDB, polars and Arrow read them directly. Lakehouse semantics proper are the next specification revision, not a shipped claim.
It is also the sanctioned answer to shadow IT. A team can stand up a proof of concept against real data inside the trust boundary, with one explicit and auditable export boundary rather than silent background replication — and platform teams can revoke a node as an MLS membership operation when the experiment ends. Prove the value before committing the budget.
5. Where else it fits
5.1
AI training data
Private behavioural, sensor and access histories from humans and agents that must stay in their owner’s custody while remaining trainable on.
5.2
Edge and IoT
Gateways collect while disconnected, links are metered and unreliable, history lands somewhere that must not read it.
5.3
Self-hosted and personal
Replicated across your own devices instead of a provider’s.
5.4
Research datasets
Confidentiality obligations met while still replicating for durability.
5.5
Small-team operational data
Stays inside a trust boundary and survives any single machine failing.
5.6
Archival to untrusted storage
Including rented capacity, with cryptographic rather than contractual assurance.
6. What it does not claim
Being explicit about this matters more than the feature list.
The mesh spans one trust authority. It is not a protocol for sharing data between mutually distrusting parties, and it does not provide collaborative multi-writer editing semantics.
Note — Revocation does not reach back
Note — Metadata still leaks
Note — No recovery key
Note — Not shipped