Your servers
On-prem, private cloud, or fully air-gapped — the same stack either way. No cloud-only control plane, and no feature that quietly needs the internet to work.
helm or compose · one codebase, three modes
Airspace you hold, not rent.
Strategic deconfliction, Remote ID, and the evidence to prove both — running on your servers, inside your jurisdiction.
Verified, not certified — every claim below maps to a check you can re-run yourself.
LIVE · scripted demo
Corridor conformance nominal
OP-4471 · 3.2 km flown · lateral deviation 6 m
Deconfliction cleared
F3548-21 · 0 conflicting operational intents
Remote ID broadcasting
F3411 v22a · SP + DP
What is actually in the box
22
Microservices behind one gateway
A single external boundary. Identity is derived from the token — never from a header a client can set.
kong · default-deny backstop
F3548-21
Strategic deconfliction
Operational intents shared and checked against a real DSS. The InterUSS qualifier suites pass with zero findings above Low.
verified 2026-06-10
F3411
Network Remote ID
Service Provider and Display Provider roles, v19 and v22a, verified by that same qualifier run.
make uss-qualifier
RLS
Per-tenant isolation in Postgres
Row-level security enforced by a non-owner runtime role. Cross-tenant reads and writes are behaviourally tested, not assumed.
verify_tenant_rls.py
Sovereign UTM, defined
Three things you either own, or you do not.
The word gets used loosely. Here it means something checkable: a runtime you control, data that never crosses your boundary, and conformance evidence you can regenerate without asking us for it.
Your data
Telemetry, Remote ID and the audit trail live in your PostgreSQL, under your backup policy. Residency becomes a property of the deployment rather than a clause in a contract.
open-format export · no vendor tenant
Your evidence
Conformance is a suite you run, not a document we send. Hash-linked audit records carry actor, tenant and correlation id from the decision through to the archived flight.
verified, not certified
Capabilities
Labelled honestly, including where it hurts.
GA means behaviourally covered and in production use. Beta means it works and is still moving. Preview means you can see it, not depend on it. Nothing gets promoted without the evidence its label implies.
Deconfliction & airspace
ASTM F3548-21 strategic deconfliction
Operational intent sharing, conflict detection and constraint awareness against a real DSS.
GA
ASTM F3411 Network Remote ID
Service Provider and Display Provider roles, v19 and v22a, verified against the reference DSS.
GA
ED-269 geozone authoring & lifecycle
Draw, version and publish geographical zones; schema-validated import and export.
GA
JARUS SORA 2.5 risk assessment
Full ground and air-risk methodology with the complete SAIL table — advisory, and pinned in CI.
GA
Fleet, docks & the field
DJI FlightHub 2 sync
Projects, devices, completed flights and telemetry tracks pulled into your own database. Push stays off until you turn it on.
Beta
Field gateway with store-and-forward
MAVLink in, buffered across intermittent links, replayed in order when the link returns.
Beta
Live video wall with evidence recording
Cellular-resilient SRT ingest, bound to the mission record it belongs to.
Beta
Response & intelligence
DFR dispatch
Alarm in; an airspace- and SORA-pre-checked launch proposal out. The operator still makes the call.
Planned
AI detection & incident reasoning
Detection on the video wall, local model reasoning over what it saw. No frame leaves the premises.
Preview
Cross-border authority delegation
Multi-authority workflows for national and regional programmes.
Beta
The product
Controls float. Airspace never hides.
9Active ops
1Conformance alert
3Awaiting approval
26Aircraft ready
Operations in progress
auto-refresh
OP-4471
Corniche seawall survey
Nominal
OP-4468
Substation thermal sweep
Altitude drift
OP-4465
Perimeter response · Dock 2
Off corridor
OP-4462
Pipeline right-of-way patrol
Nominal
Layers
Live tracks · 14
Restricted zones · 3
Conforming · 13
Alerting · 1
Selected
OP-4471
118 m AGL · 11.4 m/s · 42 min remaining
Scripted demo data. Every surface above is clickable in the prototype dashboard.
The ledger
Dated receipts, not slogans.
Either a real date for a run we stand behind, or the literal cadence for a check pinned continuously. Nothing else earns a place on this page.
ASTM F3548-21
Strategic deconfliction against the InterUSS DSS — qualifier suites pass with zero findings above Low severity.
2026-06-10
ASTM F3411 v19 / v22a
Remote ID Service Provider and Display Provider, verified by the same qualifier run.
2026-06-10
JARUS SORA 2.5
Full ground and air-risk methodology with the complete SAIL table — behaviourally pinned, not a lookup stub.
every CI run
EUROCAE ED-269
Geographical-zone lifecycle, schema-validated against the ED-269 model.
every CI run
EU 2021/664 U-space
Mandatory U-space service coverage across the platform capability set.
every CI run
ASTM F3548-21
ASTM F3411
JARUS SORA 2.5
EUROCAE ED-269
EU U-space
Verified, not certified.
One codebase, three shapes.
The same platform ships as an operator programme, an authority, or a national system. Nothing is a different product with a different price list — it is a deployment mode, and you can move between them.
Operator
Enterprise programmes
- Plan → fly → prove, with SORA 2.5 and live conformance
- Edge ingestion, video wall, fleet and crew management
- Your Kubernetes, or a single Compose host
Authority
CAAs & ANSP units
- Approval workbench with jurisdiction rules and SLAs
- ED-269 geozone authoring and cross-operator supervision
- Hash-linked audit trail with evidence export
National
Country-scale
- DSS federation, Network Remote ID, CISP interfaces
- Multi-authority delegation and cross-border workflows
- Multi-region deployment with geo-replication
And the room you run it from.
Most vendors will operate your programme for you, from their centre. We design, build and commission yours — the wall, the consoles, the radios, the runbooks and the crew — then hand you the keys and leave.
Evaluate it on your own infrastructure.
Thirty days of the full Pro tier, the same installer we ship to production, and the complete evidence trail a tender review will ask for.
No vendor account. No phone-home. Licences verify offline.