Sovereign Compliance Gateway — Verifiable Payment-Data Residency
Technical Ledger
| SKU | VLA-GEN-SOV-V1.0 |
|---|---|
| Vendor | Vlaander LTD |
| Classification | Engineering Asset |
| Variant | Default Title |
| Availability | ProvisionedPASSING |
Provenance & integrity.
| Language | C++23 |
|---|---|
| Build | clang++ -std=c++23 -Werror |
| Sanitizers | ASan · UBSan · TSanPASSING |
| Fuzzing | libFuzzer continuous corpusPASSING |
| Signing scheme | ed25519 signed releases |
| Signing key | Publishing 2026-Q3 |
| SHA-256 | Publishing 2026-Q3 |
| Release | Publishing 2026-Q3 |
| External audit | Publishing 2026-Q3 |
Value, in your metrics.
Per-product value translation publishing 2026-Q4 — email sales@vlaander.com with your stack profile to receive the translation ahead of publication.
Build-vs-buy basis.
Per-product basis publishing 2026-Q4 — until then, the institutional default applies: senior C++ team at $25,000 loaded cost per engineer-month, 15% risk premium on the high end of the build estimate, opportunity cost excluded by default. Email sales@vlaander.com for the per-product paragraph ahead of publication.
Risk allocation.
| Risk | Borne by | Basis | Buyer’s recourse |
|---|---|---|---|
| IP cleanliness | Vlaander LTD | Source warranted as original work, clean of third-party IP at point of sale. | Indemnification capped at the purchase price paid. |
| Benchmark performance | Vlaander LTD | Published numbers must reproduce on the documented hardware. 30-day inspection window from delivery. | Refund of the purchase price within the inspection window. |
| Integration into buyer’s stack | Buyer | Integration footprint published on every product page. No warranty extends to bespoke environments outside the documented targets. | Use the published footprint as the integration spec; engage Vlaander engineering at sales@vlaander.com for paid support. |
| Regulatory compliance in buyer’s jurisdiction | Buyer | Export classified EAR99. Buyer self-screens against restricted jurisdictions and parties under their own legal counsel. | Request a pre-sale export review at sales@vlaander.com — provided at no charge. |
| Vendor continuity | Buyer | No vendor can warrant its own continuation. Source delivered without licence server, kill-switch, or expiry — risk transferred to buyer by the outright-sale model. | Self-maintain in perpetuity using the delivered source; fork freely under the Sale terms. |
| Source-code escrow | Joint | Source is delivered to the buyer at sale, so escrow is structurally unnecessary. Available on request when buyer counsel mandates a third-party deposit. | Request escrow at sales@vlaander.com — buyer-funded; Vlaander participates without charge. |
| Security disclosure post-sale | Joint | Vlaander acknowledges security reports within 24 hours and honours coordinated disclosure indefinitely on shipped versions. Buyer applies remediation in their environment. | Report to sales@vlaander.com — disclosure policy published at /security. |
System Abstract
Pure-software middleware that gives Nigerian financial institutions provable, continuously-verifiable compliance with the CBN payment-data-residency mandate — where the operator itself is in the threat model.
Banks already have to localise the data; what they cannot easily do is prove it, continuously, in a form CBN accepts under sanction. That gap is the product. The gateway observes where payment data lives out-of-band — never in the payment path — classifies and cryptographically attests each residency decision, chains those attestations into a tamper-evident RFC 6962 transparency log, and renders the CBN return, such that a regulator can verify any transaction's compliance without trusting the bank or the vendor.
The trust plane is built so the operator cannot cheat: witnessed N-of-M quorum and threshold co-signing make non-equivocation and history tampering detectable, and a standalone verifier checks every proof against a pinned public key. One vendor-neutral codebase — no bank, cloud, or data format named in the fixed core — serves one institution or fifty through a multi-tenant central plane, with every environment-specific concern behind a pluggable seam.
A security-audited, sanitizer-clean reference implementation of verify-don't-trust residency compliance. Delivered as source, sold outright.