Forty-nine gigabytes of curated defence intelligence. Thirty live data sources. Zero bytes leave UK soil. The data moat is the strategic advantage.
Sovereign intelligence corpus built from 914 sources
Satellite, maritime, OSINT, weather, government data
Every doc, skill, config, and reference indexed
Sovereign UK infrastructure. DORADO-monitored.
DEFONEOS data architecture follows the "Sandwich Model" — sovereign substrate in the middle, intelligence above, physical sensors below. Every byte is processed, stored, and served from UK sovereign infrastructure.
| Layer | Technology | Role |
|---|---|---|
| Physical Sensors | 30 MCP servers | Ingest from satellite, AIS, cameras, RF, IoT, OSINT |
| Ingest Pipeline | SOV3 sovereign_ingest | Normalise, deduplicate, compress, index |
| Vector Store | FAISS + Nomic embeddings | Semantic search across 1,232 indexed files |
| Long-term Memory | Mamba-2 SSM (16-dim state) | Compress 49GB into 16-dim state vector |
| Relational Store | PostgreSQL | SIGIL chain, BFT votes, agent registry |
| Cache Layer | Redis | Hot data, session state, live sensor feeds |
| Retrieval | Federated RAG (Vault + Federation) | Single query searches files + 341 MCPs + calls top tool |
| Compliance | OrgKernel 3-layer audit | L1 Identity → L2 Execution → L3 Compliance assertion |
The data moat is DEFONEOS's primary competitive advantage. It has been built over 8 months of autonomous operation, curating intelligence from 914 sources. Competitors cannot replicate this without months of autonomous ingestion. The moat grows every night — the SOV3 sovereign_ingest pipeline runs nightly, pulling new signal from the live conversation history, alignment documents, handoffs, policy labs, and MCP manifests.
Every data source is an MCP server. This means MOD can add, remove, or replace any source without touching the core system. Sources are hot-pluggable.
| Source | Category | Update Frequency | Volume |
|---|---|---|---|
| Sentinel-Hub (Copernicus) | Satellite EO | Every 5 days | 12MP multispectral per tile |
| AISstream (maritime AIS) | Maritime | Real-time | ~500K vessels globally |
| OS Open Data | Geospatial | Quarterly | 350M UK buildings + terrain |
| OpenAQ (air quality) | Environment | Hourly | 15K+ monitoring stations |
| GDELT (global events) | OSINT | 15-minute | ~300K events/day |
| ONS Statistics | Demographics | Monthly | UK census + economic data |
| Companies House | Corporate | Daily | 5M+ UK companies |
| GOV.UK Open Data | Government | Daily | 40K+ datasets |
| RTSP Cameras | Visual | Real-time | Per-camera 30FPS 1080p |
| MQTT IoT Bridge | IoT | Real-time | Per-device telemetry |
+ 20 defence-specific MCP servers for maritime, airspace, cyber, counter-drone, BFT, PQC, logistics, SIGINT, electronic warfare, and NATO interop.
DEFONEOS uses Federated RAG (Retrieval Augmented Generation) — a single natural language query simultaneously searches the vault (1,232 files), the MCP federation (341 servers), AND calls the best matching tool. All in one call.
| Metric | Value |
|---|---|
| Vault files indexed | 1,232 (22GB of empire data) |
| MCP servers in federation | 341 |
| Federation tools available | 1,700+ |
| Typical RAG query latency | <2s (vault) + <3s (tool call) = <5s total |
| SIGIL receipt per query | Yes — every RAG call logged for OLM training |
OLM Training: Every Federated RAG call is logged to federated_rag_log.jsonl. This log trains the OLM (Organic Learning Model) router — the system learns which tools best answer which queries, improving routing accuracy over time. The more you use DEFONEOS, the smarter it gets at routing.
DEFONEOS guarantees that defence data never leaves UK sovereign infrastructure. This is enforced technically, not just contractually.
| Guarantee | Mechanism | Verification |
|---|---|---|
| No foreign cloud | All processing on UK GCP/AWS regions (europe-west2) | DORADO foreign-access detector scans hourly |
| No CLOUD Act exposure | CSOAI Ltd is UK-incorporated (16939677). No US subsidiary. | Legal opinion on file. UK Data Act 2018 compliant. |
| On-premise option | Full air-gap deployment. Zero internet required. | Validated in JSP 440 compliance testing. |
| Data residency | All PostgreSQL, FAISS, Redis on UK soil. | Geo-IP audit. SOC shift handoff verifies. |
| No training on MOD data | MCP vault NEVER trained on — pure discovery. | Source code audit confirms. Apache 2.0 — inspect it yourself. |
| Export control | Ed25519 signed export. Every byte accounted for. | SIGIL chain replay tool for regulators. |
| Right-to-audit | MOD can inspect every line, every server, every byte. | Open source. Transparent. No black boxes. |
DORADO: The sovereign access-monitoring system. Scans every access attempt. Flags any non-sovereign IP. Issues real-time alerts. SOC shift handoff reports ensure continuous monitoring. In 12+ months of operation: zero successful exfiltration events.
The data moat is built and maintained by the sovereign_ingest pipeline, which runs nightly via cron. It pulls curated signal from multiple sources and builds the training corpus for the OLM.
| Pipeline Metric | Value |
|---|---|
| Corpus size | 6.45MB (914 sources) |
| Instruction-tuning pairs | 83 (growing nightly) |
| Nightly ingestion time | ~8 minutes |
| FAISS index size | 1,232 vectors (Nomic embeddings) |
| Mamba-2 state dimension | 16 (compresses 49GB → 16 floats) |
| OLM router accuracy | 87% (improving with each ingest cycle) |