Trustaige · Sovereign regions
Identity that never leaves your jurisdiction.
A Trustaige region is a complete, self-contained deployment of the platform — the database, the secret store, and every running component held in-country on certified infrastructure, with key material in your custody. Built with a small group of design partners, first for the markets where residency is now law.
What a region pins in-country
Residency you can point an auditor at.
“Where does our data live, and who holds the keys?” is the first question every regulated procurement asks. A region answers it component by component — not with a policy document, but with where things physically run.
The database
Directory, groups, devices, policy — the tenant record itself, on in-country storage.
The secret store
Per-tenant encrypted vault, with customer-managed keys (BYOK) so the root of trust stays in your custody.
Every running component
A self-contained control plane — no global service reaches into in-region tenant data.
The audit trail
Append-only event log, retained to your regulator’s floor, exportable in the formats they read.
Backups and failover
Primary and secondary sites both in-country, geographically separated, with tested recovery.
The sign-in boundary
Passkeys are cryptographically bound to the region’s domain — the sovereignty boundary and the phishing-resistance boundary are the same boundary.
The design partner programme
Built with the people who are compelled to need it.
National cloud-residency standards are taking effect across the markets we serve. The first region is being built with a small group of organizations under those mandates — shaped by their requirements, and theirs to go live on first.
What you get
- Direct influence on the region roadmap
- Pricing locked for your initial term
- A named place in our certification filing
- Early access as the region is built
- Plain answers on what we can commit to, and by when
What you give
- A named executive sponsor
- Requirements and validation sessions at an agreed cadence
- Timely feedback on pilot releases
- Your name — as a reference, with your approval each time
- Entry
- From 500 seats, on the Premier tier
- Minimum term
- 12 months, dated from go-live — never from signature
- Discretion
- Organizations under a binding residency mandate are considered below the seat threshold
Available today, every tier Per-tenant encryption — each organization’s secrets and credentials in a dedicated, isolated store, never blended with another tenant’s.
Apply to be a design partnerStart a conversation
If your auth layer is on the agenda, so are we.
We'll walk through a working deployment, map it to your stack, and tell you honestly where Trustaige fits — and where it doesn't.