Sovereignty by Architecture: Ross Norrie on Rethinking Data Control

In this exclusive feature, Ross Norrie, Founder and CEO of SkyeConnex, shares how data sovereignty, cloud security, and artificial intelligence are transforming data protection. A two-time technology founder, Ross previously founded AssetMetrix, acquired by Microsoft in 2006, and brings extensive experience in cloud architecture, cybersecurity, and AI strategy.

Through SkyeConnex, Ross is advancing Data Sovereignty as a Service (DSaaS), helping organizations protect sensitive information through client-side encryption, distributed cloud storage, and zero-knowledge architecture. With innovations such as Raidr and SkyeGXU, Ross aims to strengthen data security, support sovereign AI development, and give businesses greater control over their data.

What does “data sovereignty by architecture, not by promise” mean, and why does it matter today

Most sovereignty on the market is a promise. A provider tells you your data lives in Canada, signs a nice contract, and puts a maple leaf on the slide. Then a US court sends a CLOUD Act order and everyone finds out who the contract actually works for. Spoiler. It isn’t you.

Sovereignty by architecture means the system is built so the promise doesn’t matter. Your data gets encrypted on your side before it leaves. Then it’s split into shards and spread across independent hosts in the jurisdictions you pick. No single provider has enough to rebuild a file. The keys stay with you. So when someone gets compelled to hand over your data, they can hand over whatever they like. It’s noise.

This matters now because Treasury Board told departments this fall to assume breach. That’s the government admitting the perimeter is going to fail. Fair enough. If you’re going to be breached, the only question left is what the attacker gets. With architecture the answer is not much.

Add every AI tool on the planet wanting a copy of your data and promises start looking pretty thin.

How does SkyeConnex give organizations greater control over sensitive data without replacing their existing cloud providers

We don’t ask anyone to leave their cloud. That would be a very short meeting. The hyperscalers are good at what they do and they’re wired into everything you run. Tearing all that out to get sovereignty is like selling the house because you want a better lock.

So we sit on top. SkyeConnex is a custody layer, Data Sovereignty as a Service. Bring your own cloud. Data gets encrypted client-side, broken into shards and spread across whatever providers and jurisdictions your policy allows. AWS, Azure, a Canadian host like ThinkOn, or all three. Each one holds a piece that’s useless on its own.

Users barely notice. There’s an S3-compatible gateway so your apps and databases keep working, a drive in Windows Explorer and Microsoft 365 integration. Nobody needs a training course.

And you get your leverage back. If a provider jacks up prices, gets sanctioned or shuts off your account, you rebuild from the surviving shards somewhere else and carry on. Funny how much nicer vendors get once they know you can leave.

How can organizations use AI on sensitive data while maintaining security, sovereignty and control

Most companies handle AI on sensitive data by copying it into someone else’s platform and hoping the terms of service hold up. Bold strategy.

We go the other way. With SkyeGXU the data stays in custody and the compute comes to it. Shards only reassemble inside a boundary the customer controls. That can be their own machines or a hardware-attested enclave on a GPU. The model runs in there, results go back into custody, and nothing sits in plaintext on gear you don’t trust. We’ve been running governed distributed AI on customer-owned hardware since 2025.

It sits under the tools data teams already use. Notebooks, Databricks, whatever analytics platform they’re already paying for. Nobody has to learn a new workbench to stay compliant.

Then there’s provenance. You need to know which data trained which model under what policy, and be able to prove it when the auditor shows up. And people forget the model itself. Weights trained on your sensitive data are your sensitive data.

AI just made the sovereignty problem obvious. Now the thing leaking your data is also really good at summarizing it.

What did building AssetMetrix and its acquisition by Microsoft teach you that you are applying at SkyeConnex today

We started AssetMetrix around 2000 and built the first IT SaaS platform, back when you had to explain what SaaS meant at every meeting. Microsoft bought us in 2006 and the tech ended up foundational to Intune and Microsoft Graph. So I’ve seen this movie.

Being early costs money. You spend years explaining the category before anyone signs. If you’re paying for that education anyway, you might as well own the category. That’s why SkyeConnex created DSaaS and says so.

Don’t pick a fight with the giants. Going head to head with Microsoft or AWS is a great way to become a case study. AssetMetrix made their world better and SkyeConnex sits on top of the hyperscalers for the same reason.

Let partners do the selling. We’re OEM and channel first. Partners like ThinkOn host us, sell it as their own and keep the margin. We stay small and we never compete with the people bringing us deals. Our one, three and five year pricing came straight from AssetMetrix. It worked then.

And build security in on day one. Bolting it on after a few thousand customers is its own special kind of misery.

Where do you see the greatest demand for data sovereignty today, particularly across government, defence and regulated industries

Government and defence, and it isn’t close. Canada spent the last year finally saying the quiet part out loud. Data sitting in Canada with a foreign-owned provider is still reachable by foreign law. Once that landed, sovereignty went from a slide in a policy deck to a line in the procurement. Assume breach and the new CAN/DGSI 100-8 standard pushed it further.

Defence is the sharp end. Allies need to share data without actually handing it over. Letting each country keep custody while still working together is pretty much the whole game.

Regulated industries are right behind. Healthcare, banks, critical infrastructure. Same exposure, fewer clearances, more class-action lawyers.

Then there are SMEs, who mostly don’t see it coming. Every mid-sized company selling into government or a regulated supply chain is about to inherit all of this. They don’t have a fifty-person security team. They need sovereignty they can switch on like any other service.

It’s not just us either. Europe has been at this for years and Australia is heading the same way. Everyone is asking the same question. Who can actually open our data?

Disclaimer:

The views and opinions expressed in this interview are those of the interviewee and do not necessarily reflect the official policy or position of CanadianSME Small Business Magazine. Our platform is dedicated to fostering dialogue and sharing insights that inspire and empower small and medium-sized businesses across Canada.