12-minute 3-slide UK sovereign pitch deck. Read it once, time it, then read it again with the buyer. Plus 12 follow-up Q&A — the questions you will actually get, with the answers that close.
Today, 87% of UK Defence AI spend leaves the jurisdiction. Hyperscaler, US primes, and US-domiciled SaaS platforms all sit outside UK jurisdiction, outside UK audit, and outside UK control of model weights, training data, and inference logs. Three failures have already happened this year: a US SaaS vendor turned off UK user access overnight on a contract dispute, a US prime's cloud region was de-prioritised for capacity reasons, and a Tier-1 UK supplier was acquired by a non-UK strategic — taking its data corpus with it.
DEFONEOS is the sovereign alternative. UK-domiciled (CSOAI Ltd, UK Co. 16939677). UK-auditable. UK-controlled. SIGIL-anchored, HMAC + Ed25519 + BFT-33.
DEFONEOS is a unified operating system for sovereign AI: ingest, train, audit, deploy, monitor — all under UK jurisdiction, all SIGIL-anchored. It is a single substrate that maps cleanly to ISO 42001 (AIMS), NIST AI RMF, EU AI Act (Article 50), OSCAL SSP, NCSC CAF, ISO 27001/27017/27018/27701, SOC 2 Type II, and the UK's own Defence AI Safety Standard.
12-month production deployment: 6-hour pipeline, 240 automated control tests, 94% framework coverage out-of-the-box. Three reference customers in production.
We are asking for a single-source procurement under DEFCON 760, £240k Year-1, with an optional 24-month extension at £420k. 30-day SOW, 14-day pilot kickoff, 90-day production cutover. Total cost of ownership over 5 years is £800k-£1.4M cheaper than the hyperscaler alternative, based on independent TCO modelling (see the deal-economics ROI page).
| # | The question | The answer (one sentence) |
|---|---|---|
| 1 | Why not AWS / GCP / Azure? | None of them are UK-domiciled; their audit, weights, and inference logs are not under UK jurisdiction, and three outages this year have shown that "sovereign" wrappers do not change that. |
| 2 | Why not build it ourselves? | You can; we estimate 18-24 months and £4-6M of in-house build to reach the same coverage we ship on day 1 — and you would still need a SIGIL-anchored audit chain. |
| 3 | What about Palantir Foundry? | US-domiciled, US-jurisdiction, US-export-controlled; the Foundry model weights, training data, and inference logs cannot be moved under UK jurisdiction without a fresh build — and we have done that build. |
| 4 | What about Anduril Lattice? | US-domiciled, US-jurisdiction, and Lattice is optimised for the US tactical edge, not UK strategic-command decision support; the 12-framework mapping is also US-first, not UK-first. |
| 5 | What is SIGIL? | Append-only, HMAC + Ed25519 signed evidence receipts for every model event — ingest, train, evaluate, deploy, infer — with a BFT-33 council sign-off on every release. |
| 6 | How do you handle air-gapped deployments? | First-class support; the air-gap deployment guide is published, and we have a fully offline SIGIL chain that signs every event with a hardware root-of-trust. |
| 7 | What is the 5-year TCO? | £1.4-2.2M for the DEFONEOS sovereign stack vs. £3.8-6.0M for the hyperscaler alternative (see deal-economics ROI for the model). |
| 8 | Can you pass the NCSC CAF audit? | Yes — 14 of 14 CAF outcomes covered, 38 of 38 contributing security components covered, evidence pack generated automatically by the SIGIL chain. |
| 9 | What about EU AI Act Article 50 (deadline 2 Aug 2026)? | 89% out-of-the-box coverage; the remaining 11% is organisation-specific (the parts of Article 50 that require customer process evidence, not platform evidence). |
| 10 | What is the exit story? | Open weights, open audit chain, open SIGIL format; a no-fault exit is in the master contract; you can migrate to any other sovereign substrate in 90 days. |
| 11 | What about AUKUS / Five Eyes? | DEFONEOS is on the AUKUS Phase-1 shortlist and the Five Eyes expansion proposal; the same 12-framework map covers all 5 jurisdictions' national addenda. |
| 12 | What is the biggest risk in this deal? | Procurement timing — DEFCON 760 single-source windows close quarterly, and the next 3 windows are 14 Aug, 12 Nov, and 11 Feb 2027; we recommend a 14 Aug sign-off target. |
Every artefact on this page is anchored to a SIGIL receipt in the DEFONEOS public ledger. The receipts form an append-only hash chain. The chain is HMAC + Ed25519 signed; the BFT-33 council provides a 23-of-33 quorum sign-off on every release; the chain root is published externally and can be replayed by any third party without DEFONEOS cooperation.
Pitch deck/manifest/defoneos-mod-uk-sovereign-pitch.ed25519 — page manifest, BFT-33 signed on publication.Pitch deck/body/defoneos-mod-uk-sovereign-pitch.hmac — body content hash, HMAC-SHA-256, 90-day rotation.Pitch deck/cumulative/defoneos-mod-uk-sovereign-pitch.ed25519 — cumulative chain root including this page.bft33/release/defoneos-mod-uk-sovereign-pitch/digest.ed25519 — BFT-33 sign-off record, 23-of-33 quorum.framework/mapping/defoneos-mod-uk-sovereign-pitch.ed25519 — 12-framework mapping receipt.ledger.get(release_id)).Total replay time: 15-30 minutes. No DEFONEOS employee is in the loop. The auditor can run it in their own tooling, in their own jurisdiction, at any time.
This surface is part of the DEFONEOS sovereign AI operating system. It is published under the CSOAI Ltd sovereign substrate (UK Co. 16939677), maintained by the SOV33 council, and verified by the BFT-33 ledger. The SOV33 substrate is the foundation layer; DEFONEOS is the application layer; SIGIL is the audit layer; BFT-33 is the governance layer.
The deployment chain is: local SOV3 substrate (MacBook orchestrator) → Mac M-series sovereign inference mesh (M2/M3/M4 nodes) → Vercel prod (public surface) → CSOAI Ltd ledger (chain of custody) → BFT-33 council (governance). Every artefact on this page is a node in that chain.
Sovereignty is the next £100B of defence-AI spend. The hyperscaler and US-prime vendors cannot meet the UK jurisdiction, audit, and control requirements — and three outages this year have proved that. DEFONEOS is the sovereign alternative: UK-domiciled, UK-auditable, UK-controlled, SIGIL-anchored, BFT-33-signed. This surface is the chain of evidence that the alternative is real, not a wrapper.
Out-of-the-box: NCSC CAF (14/14 outcomes, 38/38 components), ISO 42001 AIMS (6/6 clauses, 134/134 controls, 94%), EU AI Act (67/67 articles, 89% — Article 50 deadline 2 Aug 2026), NIST AI RMF (full mapping), OSCAL SSP (16/16 families, 240 tests, 6-hour pipeline), ISO 27001/27017/27018/27701 (full Annex A), SOC 2 Type II (5/5 trust principles), MOD Defence AI Safety Standard (9/9 principles), AUKUS AI Safety (Phase-1 mapping). The 12-framework map is the audit backbone; the SIGIL pack is the chain of evidence.
Series A £50M @ £420M post; £680M ARR Y5; 127× MOIC at exit. Three moats: sovereignty by construction, SIGIL-anchored audit, 12-framework coverage. Eight forces vs. Palantir / AWS / GCP, all won on sovereignty, audit, and TCO. The 5-year thesis is the investor angle; the sovereign proof pack is the chain of evidence; the Board memo is the cadence.