Sovereign by construction.
Security here is not a compliance page. It is the architecture: post-quantum sealing by default, keys that never leave your enclosure, lineage signed on every object, and zero required outbound calls. Named algorithms, cited standards, no adjectives.
Assume the computers of the 2040s
Data sealed today must survive adversaries who record now and decrypt later. Midgard therefore encapsulates keys post-quantum by default, no legacy mode, no opt-in checkbox.
| Layer | Algorithm | Standard |
|---|---|---|
| Key encapsulation | ML-KEM-768 (default) · ML-KEM-1024 (high assurance) | NIST FIPS 203 |
| Symmetric sealing | AES-256-GCM | NIST FIPS 197 · SP 800-38D |
| Signatures, lineage & releases | ML-DSA-65 | NIST FIPS 204 |
| Hashing, content addressing | SHA-256 / SHA-3-256 | NIST FIPS 180-4 · FIPS 202 |
An ML-KEM-768 public key is 1184 bytes. If yours isn't, the platform tells you the fact and the fix: regenerate with midgard keygen.
What never leaves
Generated inside the enclosure, held by you, rotated by you. Unsealing is an audited event. Veldris cannot read your objects, by construction, not by policy.
Mimir runs models locally, pinned by hash. No prompt, no embedding, no telemetry crosses the boundary. Air-gapped operation is a supported mode, not a degraded one.
Zero required outbound calls. The platform is fully functional with the cable unplugged; anything optional that talks out is off by default and named in the source.
Lineage is the security model
Every object carries a signed, append-only lineage: what produced it, from which inputs, under whose authority. Every access decision the platform makes is logged against that line.
This is why a breach investigation in Midgard is a query, not an archaeology project, and why a claim on this website can carry a provenance tag instead of an asterisk.
The supply chain holds the same standard. Builds are reproducible; releases ship a signed SBOM; Bifrost refuses to deploy anything that cannot prove its origin, on either side of an air gap.
And because the core is open source, none of the above asks for your trust. Read the source →
Assessed, not asserted
Veldris Ltd is certified under Cyber Essentials, the National Cyber Security Centre-backed scheme, assessed by Synovum Cyber Security in partnership with IASME. The scope is the whole organisation, no carve-outs.
In this company's terms: a certificate is a claim, and claims carry provenance. The certificate number is below and the register is public, so verify it yourself rather than take the badge's word for it.
The certificate attests that at the time of testing the organisation's defences were assessed as satisfactory against commodity cyber attacks. It is a baseline, not a boast; the architecture above it is where the real guarantees live.
On the record
| Scheme | Cyber Essentials · NCSC |
| Certificate | 772fd04c-3a1d-4308-8c72-92b3291be902 |
| Certified | 2026-08-26 · recertification due 2027-08-26 |
| Profile | 3.3 (Danzell) |
| Scope | Whole organisation |
| Certification body | Synovum Cyber Security · IASME partner |
Watched from outside
Veldris is registered with the National Cyber Security Centre, and every online asset we operate, veldris.io and the infrastructure behind it, is enrolled in the NCSC's Early Warning service. The NCSC correlates its threat intelligence, incident reports, malware sightings, network-abuse events, vulnerability and open-port scans, against our registered assets and alerts us the moment one of ours appears in the data.
The point is time. Most damage happens in the gap between something going wrong and the operator finding out; an independent watcher with national-scale telemetry shortens that gap to hours. Alerts are triaged the working day they arrive, and a confirmed signal is handled in this company's usual temperament: the fact, then the fix. If an event ever touched personal data, the duties in the privacy policy apply, including 72-hour notification to the ICO.
We do not mark our own homework. The baseline is certified by others (§ 4), and the perimeter is watched by others. Never hiding the mechanism includes the failure channel.
| Registered with | National Cyber Security Centre |
| Service | NCSC Early Warning |
| Coverage | All online assets: veldris.io and supporting infrastructure |
| Feeds | Incident notifications · network abuse · vulnerability and open-port alerts |
| Response | Triaged the working day received · fact, then fix |
Found something?
Report vulnerabilities to security@veldris.io. State what you found and how to reproduce it; we respond with the fact and the fix, and we credit reporters who want credit. No legal threats for good-faith research, in writing.
Personal-data concerns are a separate line: Veldris Ltd is a registered data controller (ICO reference ZC222667) with a named Data Protection Officer, JB Webb-Benjamin, at j.benjamin@veldris.io. The privacy policy has the full inventory.
AES-256-GCM under ML-KEM-wrapped keys. Read the source.