Standards · Security
Inside the Crown perimeter. Always.
Built for the certifications Canadian agencies must operate under — not a foreign-prime checklist with a Canadian decal. Every posture below is auditable, every standard tied to a deployment-kit artefact, every claim covered by a signed instrument.
Controlled Goods Program
Valley Creek Labs is a registered Designated Official under Canada's CGP. Operator workstations, appliances, and source code reside on CGP-compliant infrastructure with Crown-cleared personnel.
ITAR-bounded models
Every ML model used inside NEXUS is enumerated by license, training data lineage, and export authority. Nothing in production is trained on data we cannot disclose to your CIO.
ATIP-ready disclosure
Every operator action and every model call is recorded with timestamp, classification, and provenance. ATIP exports bundle the request, the operator session, the model call trace, and the reasoning citations as a tamper-evident PDF.
Stinchcombe disclosure
Investigation workspaces flag every privileged, s.8, or third-party-source record at ingest. Disclosure rollup tiles update live. Stinchcombe-ready export is a one-click PDF with provenance chain attached.
PKI · TLS · zero standing access
Operator authentication is via CAF PKI or RCMP CPIC integration. Workstation ↔ appliance communication is mTLS 1.3 on an inside-boundary network. No standing access; every privileged action is consent-prompted and logged.
Crown perimeter sovereignty
NEXUS Edge runs entirely inside the agency network boundary. No telemetry, no model calls, no metadata leaves the perimeter. Federation across agencies is opt-in by signed instrument, partner by partner.
Procurement-clean across the five frameworks that actually gate a Crown deployment.
| Framework | NEXUS coverage |
|---|---|
| TBS Directive on Service & Digital | Operator workstation pattern · digital service standard alignment |
| GC Cyber Security Event Management Plan | Logging, monitoring, and incident reporting hooks |
| ITSG-33 · CSE | Security control catalogue aligned per workstation + appliance roles |
| GoC PSPC Vendor Performance | Vendor of Record onboarding in progress · 2026Q3 |
| Five Eyes operator clearance compatibility | CAF PKI · UK MoD · US DoD CAC interoperability via partner agencies |
What we publish · what we will not.
- · Model registry under NDA
- · Architecture diagrams under NDA
- · Operator-action audit-log schema
- · ATIP export format + sample bundle
- · Stinchcombe export format + sample bundle
- · Vendor onboarding artefacts (CGP, ITAR registrations)
- · Customer agency names · until disclosure is authorised by the agency
- · Classified operator workflows · ever
- · Detection model weights · under license
- · Pricing on classified-tier deployments · per Crown procurement instrument
The deployment-kit binder for your CIO.