Cloud · AI · Sovereignty — Canada · United States · France

We ship to production.
Not to a demo.

Azure landing zones deployed as code. AI agents inside your tenant, connected to your data. And because we also know how to get you out of Microsoft, our “stay on Azure” is worth something.

See your external surface →How we engage
Scope fixed before we start · quote within 5 days · no chasing
Stays in AzureMoves — sovereignMicrosoft 365 · CopilotLine-of-business agentsAnalytics · FabricApplication modernisationEndpointsRegulated dataDefence · critical infraSovereign LLMsWe build architectures, and we design the boundarybetween what stays and what has to leave.
Architecture · Figure 1

Where your data lives,
and who can reach it.

US hyperscaler regions are everywhere — including in Europe and Canada. That is precisely what makes the jurisdictional question unavoidable: where a data centre sits tells you nothing about the law that applies to it.

Hover the figure: the cursor speeds the flows up and steers the globe.
Hyperscaler regionOperated by a US-incorporated company, wherever it physically sits.
Sovereign operatorOVHcloud, Infomaniak, Delos, Scaleway. Under European or Swiss jurisdiction.
Novarque presenceQuebec City, Orlando, Paris. We design and operate from all three.
Data flowApplication paths between regions, documented and measured.
RedundancyReplication and regional failover, within a single jurisdiction.
Extraterritorial reachWhat a US order can reach, wherever the server is.

What this map says. A data centre in Frankfurt operated by a US company is still subject to the CLOUD Act. So is one in Quebec City, if the same company operates it. Sovereignty is not decided on a map — it is decided in the architecture, and that is exactly the arbitration we document.

What we build · 01

Six proofs of concept.
Zero in production.

It is almost never a model problem. It is a foundations, governance and integration problem. We build both floors: the platform underneath, the agent on top.

01

Azure Landing Zone

Landing zone architecture, Infrastructure-as-Code deployment, hardening aligned to CIS benchmarks. Your teams keep the templates.

Deployed
02

Copilot Studio agents

Business agents on your SharePoint and processes, with access policy, logging and an audit trail from day one.

In production
03

Azure AI Foundry

Custom models and RAG pipelines on your data. Control over cost, residency, and what the model is allowed to see.

In your tenant
04

Copilot M365 at scale

Deployment, adoption and governance across every team. Turning licences on is where the work starts, not where it ends.

Adoption measured
05

Automation pipelines

Triage, routing and tracking integrated with your existing systems. We quantify the return on each process before automating a single one.

ROI quantified first
06

Sovereign and local LLMs

Private models hosted in your tenant, or air-gapped when the mandate requires it. Mistral, Delos, OVH and Scaleway deployments.

Air-gapped if required
Our expertise · 02

Four disciplines,
one team.

CISM

Security and governance

A globally recognised credential. Risk governance, compliance and security posture on every mandate — never an add-on.

Fractional CIO

Programme leadership

IT leadership on demand: transformation steering, vendor arbitration, board reporting — with an exit plan.

Cloud Architect

Azure architecture

Landing zones, network, identity and security at scale. What holds when the estate triples.

AI Engineer

AI engineering

Agents, RAG, custom models. From the scoping workshop to production inside your tenant.

Industries · 03

Six sectors where architecture is not negotiable.

Mining and metals

Mining and metals

Remote sites, converging OT and IT, sensitive production data. Resilient landing zones and segmentation.

View the practice →
Transport and logistics

Transport and logistics

Fleets, telemetry and embedded systems. Real-time integration without exposing the core network.

View the practice →
Defence and military

Defence and military

Classified environments, enclave requirements, full exit available. WIN TO LUX and air-gapped infrastructure.

View the practice →
Telecommunications

Telecommunications

Carrier scale, namespace governance, certificates and DNS across estates of hundreds of thousands of assets.

View the practice →
Energy and utilities

Energy and utilities

Critical infrastructure under regulatory scrutiny. Continuity, redundancy and continuous proof of compliance.

View the practice →
Supply chain

Supply chain

Supplier dependencies mapped, concentration analysis, change impact across the external estate.

View the practice →
How we work · 04

We do not sell.
You buy.

The difference is not rhetorical. A firm that sells needs you to sign, and its advice leans that way without anyone deciding it should. We built the opposite: nothing in how we work depends on your signature this week.

i

Scope is fixed before we start. Deliverables, timeline and amount set in the quote. No billing that drifts.

ii

The quote starts from the need, not a catalogue. We scope first, then price. Answer within five business days.

iii

The demonstration runs on your own domain. No fee, no installation. The report is yours, whether you buy afterwards or not.

iv

We will tell you not to buy when that is the answer. Including not to build anything, or to stay exactly where you are.

v

No chasing. We answer when you write. We do not pursue anyone.

How we engage · 05

Four ways in.
Scope and timeline fixed.

Secure

Namespace demonstration

Nine surfaces of your domain mapped, with no installation and no access to your systems. Report and prioritised fixes.1

Within 5 daysNo fee
Optimise

Automation audit

A map of the processes worth automating, with the quantified return on each.

2 weeksFixed fee, quoted at scoping
Build

AI agent in production

An agent scoped, built, governed and delivered on your data, with access policy and audit trail.

From 8 weeksQuote within 5 business days
Found

Azure Landing Zone

A landing zone deployed as code, hardened to CIS benchmarks, with templates your teams reuse on their own.

4 to 8 weeksQuote within 5 business days

1 Operated by us on Klarvant Namespace Command. The report is yours, with no purchase condition.

Use cases · 06

You set the line.

A partner who can only sell Microsoft cannot recommend that you stay: they would say it anyway. A sovereign host cannot recommend it either — they would lose the sale. We build on both sides.

01 — OPTIMISE

Optimise Microsoft

Get the most from your existing investment, cleanly and auditably.

  • Azure Landing Zone & Infrastructure-as-Code
  • Copilot M365 & Azure AI Foundry
  • M365 hardening and governance
  • Application modernisation
02 — EXTEND

Sovereign by design

Move beyond Microsoft where — and only where — regulation requires it.

  • Sovereign workspace (Delos, Infomaniak)
  • Hybrid M365 + sovereign architecture
  • Data residency: Canada, France, Switzerland
  • Compliance documentation per jurisdiction
03 — EXIT

Full sovereign migration

The complete exit, when it is required. This is our rare capability.

  • WIN TO LUX — Windows to Linux
  • Active Directory → FreeIPA / LDAP
  • Defence & critical infrastructure
  • Training and handover to your teams
Optimise
Exit
Where the boundary is set by law

Three jurisdictions, three obligations.
We produce the file in all three.

Quebec · Canada

Section 17 assessment

Since September 2023, Law 25 has required a documented assessment of the legal regime in the receiving state. That is a CLOUD Act risk analysis the law already mandates.2

Law 25 s.17 · PIPEDA
United States

Residency & subprocessing

Defence industrial base suppliers and organisations holding Canadian or European data: residency mapping, CUI handling, enclave posture.

CMMC · NIST 800-171 · HIPAA
France · Europe

Extraterritoriality

CLOUD Act and FISA 702 exposure, data residency, qualified sovereign alternatives, an enforceable exit plan.

GDPR · NIS 2 · HDS · Data Act

2 Section 17 of the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1). Our assessment is an architecture document; it does not constitute legal advice.

Partners · 07

A team in each jurisdiction,
a single point of contact.

Canada

  • Novarque · Montreal and Quebec CityProgramme leadership, Azure architecture, Law 25 compliance.
  • NubolifyCloud delivery and operations.
  • Canadian sovereign hostsData residency under Canadian jurisdiction.

United States

  • Novarque · OrlandoEntrazure Technologies LLC. Mid-market, CMMC and NIST 800-171.
  • MicrosoftSolutions Partner. Vendor-funded engagements.
  • One AllianceIntroduction and co-delivery network.

Europe

  • Klarvant · United KingdomNamespace Command. A deliberately small collaborator network.
  • Delos · InfomaniakSovereign workspaces, France and Switzerland.
  • OVHcloud · ScalewaySovereign infrastructure and LLMs in Europe.
Namespace security · 08

Nine surfaces.
One external estate.

Zero-integration discovery: no agent, no API key, no privileged access. Your exposed assets are identified from public sources, without expanding your attack surface.

01

DNS footprint

Domains, resolving subdomains, record inventory, change tracking between assessments.

02

Crypto and certificates

Certificate estate, TLS endpoints, expiry forecasting, post-quantum readiness.

03

Email security

SPF, DKIM and DMARC posture, transport security per host.

04

IP intelligence

Full inventory, geolocation, network operators, endpoint mapping.

05

Web surface

Page inventory, security headers, third-party scripts, look-alike detection.

06

External discovery

Shadow assets, impersonation and phishing, claim workflow, professional takedown.

07

Third-party suppliers

Dependency graph, concentration analysis, change-impact monitoring.

08

Digital sovereignty

Data residency, jurisdiction, endpoint geography, cross-border flows.

09

Technologies

Detected-technology inventory with version tracking for vulnerability assessment.

3 Klarvant® and Namespace Command™ are trademarks of Klarvant Ltd. The platform is hosted by the vendor on Google Cloud, US and Europe regions. It observes public sources and accesses none of your systems. We map that dependency like any other, including our own.

Insights · 09

What we see in the field.

Why most Microsoft partners cannot advise you on sovereignty
Sovereignty

Why most Microsoft partners cannot advise you on sovereignty

The conflict of interest is structural, not moral. It is solved by how the mandate is built.
Section 17 of Law 25, explained to a CIO
Compliance

Section 17 of Law 25, explained to a CIO

The law already requires a CLOUD Act risk analysis. Here is the document it expects.
WIN TO LUX: what leaving Windows actually costs
Migration

WIN TO LUX: what leaving Windows actually costs

Migration, training, operations. The numbers nobody puts in the proposal.

Start by seeing

What the outside sees of you.

A demonstration of Klarvant Namespace Command on your own domain. No fee, no installation, no access to your systems. The report is yours.

See your external surface →

Or book twenty minutes to scope your need.

Programmes our practitioners led at
15+Years leading
IT programmes
4Jurisdictions
CA · US · FR · CH
6Practices, from
strategy to run
CISMCertified security
on every mandate