Follow the data, not only the session.
A flight tracker for where a protected data path may travel: the zone it must stay in, the route it takes and the residency decision recorded for it.
A flight tracker for data paths.
Sessions move between systems, services and regions. The flight tracker is a view of that movement: which sovereign zone a protected path belongs to, whether its route stays inside it, and what is decided when a route would leave. In the default UK example, the zone is UK-SOV-01, processing and storage stay in the UK, and export is denied by default.
Three questions about every data path.
Which zone does it belong to?
Name the sovereign zone and its jurisdiction, such as UK-SOV-01, and state where processing and storage may happen.
Is the route allowed?
Record a residency decision for each path: allow when it stays in the zone, deny when it would leave. Out-of-zone decryption is denied and export is deny-by-default.
What can be inspected?
Tie each decision to a consent and policy record under BCCP, so the outcome can be examined later.
Read about BCCP →What an evidence record looks like.
A real certificate for one file transfer, produced by internal testing at Cyber Immune System on a preview build. It is shown as a labelled sample of the kind of record a sovereignty decision can point to.
The record
- File
- mid-year-market-outlook-2026.pdf · 1.75 MB
- Moved
- 2026-08-31, end to end through the gateway
- Anchored
- consensus block #152020
Sovereignty decision
- Jurisdiction
- UK-SOV-01
- Processing and storage
- UK sovereign zone
- Out-of-zone decryption
- Denied
- Export
- Deny by default
- Residency decision
- ALLOW
Consensus finality
All ten validators signed. A minimum of seven is required.
Tamper test
One recorded value was changed in memory from false to true. The hash chain detected the change, and 8 of 8 records were then re-verified. Key release was approved automatically on this preview build: 4 allowed, 0 denied, 0 replay refusals.
- Self-attested. It is not a third-party audit opinion.
- Not a CMVP or FIPS 140-3 validated module.
- The per-file ML-DSA signature and the archival SLH-DSA seal are marked pending on this preview build.
- The filesystem does not enforce immutability. The hash chain makes edits detectable, not impossible.
The boundary of this view.
The flight tracker is an illustrative view and shows no live telemetry. The sample certificate comes from internal testing on a preview build and is self-attested. Neither page claims that any CISP data-residency outcome has been independently verified.
What to define
The zone definitions and their legal basis, which systems report location and how, the policy version in force, and the expected behaviour when a route cannot be confirmed.
Evidence to inspect
The consent and policy record for each decision, its build and profile, a reproducible method and explicit limitations.
Review evidence requirements →See the session lifecycle under test.
Explore the boundary. Inspect the decision. Trace the recovery.