What we can prove, and what we cannot.
Every UTM vendor claims sovereignty. Most of them run your airspace on their infrastructure and ask you to take the rest on faith. The difference is not the adjective — it is whether the claims are checkable and whether the gaps are published.
This page lists both. The gap section is the longest one on it, and it is deliberately above the standards table rather than beneath it.
Artefacts you can cite
Claims, each with a way to check it
One host with a Compose file, or a Helm chart on your own cluster. There is no control plane we operate, no account we hold, and no service of ours that a flight depends on. If this company disappeared, your operations centre would keep running.
Check it: Pull the network cable and fly. Everything keeps working except the deliberately outbound integrations — DJI cloud sync and the external weather provider — because nothing else leaves the box.
Every tenant table carries a PostgreSQL row-level security policy, and the application connects as a deliberately non-owner role because an owner bypasses RLS. A query that forgets its tenant filter returns nothing rather than returning someone else’s data.
Check it: Connect as the application role and select from any tenant table without setting the tenant GUC. You get zero rows — not an error, and not another tenant’s flights.
The gateway is the only externally reachable port. It strips client-supplied identity headers, and every service verifies the token itself rather than trusting anything upstream. A forged header does not become an identity anywhere in the system.
Check it: Send a request with your own X-Tenant-ID header. It is discarded at the gateway and never reaches a service.
Actor, tenant, correlation id and originating service — for approvals, flights, geozones and fleet changes alike. The audit log is a consumer of the event mesh rather than a courtesy call from the code that made the change, so a service cannot quietly skip it.
Check it: Change an asset’s availability, then query the audit API for that asset id. The event is there with the actor who made it.
One database per service, each with published Alembic migrations. No proprietary blob format and no encrypted store only we can read. Exporting is a pg_dump, not a support ticket and not a commercial negotiation.
Check it: Dump any service database and read it. It is ordinary PostgreSQL with ordinary column names.
If this company disappeared
Continuity is a property of what you possess and can operate, not a promise from a supplier who might not be there to keep it.
The air-gapped install is the same stack as the connected one — no cloud-only control plane and no feature that silently needs the internet. The outbound integrations are declared rather than hidden: on an air-gapped deployment the weather provider resolves to none and reports no observations, instead of inventing them.
Mechanism: Single self-hosted compose/Helm stack · no phone-home
Licenses are EdDSA-signed and validated locally. The platform never calls a license server to keep running, so a vendor outage cannot switch you off.
Mechanism: EdDSA offline licensing · libs/sutm-common/licensing
You run from source you hold. Container images build from the repository you deploy, so the platform survives independent of any vendor-hosted registry or SaaS.
Mechanism: Self-built images · reproducible from the deployed repo
Every record — telemetry, evidence, audit trail — lives in your Postgres inside your boundary, exportable in open formats. No data is held hostage in a vendor tenant.
Mechanism: Per-tenant Postgres + open-format export
Known gaps
A hosted competitor cannot publish this section, because enumerating what a product does not do is only survivable when the customer can read the code anyway. That asymmetry is the reason this page exists.
The platform implements ASTM F3548-21, F3411, ED-269 and JARUS SORA 2.5, and its outputs are traceable to those documents. That is not the same as a certificate and we do not describe it as one. Where a regulator requires certified equipment, this is not it.
The DSS client is built and independently qualified, but a peer DSS endpoint is not configured by default. Until you point the deployment at one, a “clear” result means clear against the operations this deployment knows about — a smaller claim than it sounds, which is why the deconfliction screen states its coverage instead of showing a bare green tick.
Remote ID and ADS-B show aircraft that choose to broadcast. The sensor registry and track ingest accept radar, RF, optical and acoustic sources, but the surveillance adapter that would feed them is labelled Planned and ships with nothing behind it. An aircraft with its module disabled is invisible, and no screen in the product implies otherwise.
Authentication and identity have the deepest behavioural coverage, and the safety-relevant cores of SORA 2.5 and the ED-269 lifecycle are behaviourally tested too — all 40 SAIL cells, the geofence state machine. What is not: F3548 deconfliction geometry, live PostGIS breach evaluation, tenant isolation and negative RBAC, which rest on structural tests that prove code shape rather than correctness. The repository’s own testing documentation names the same list.
Maturity labels are load-bearing, not marketing gradations. A Planned integration tile is not a slow GA one — nothing is running behind it. We do not promote a label without the runtime evidence it implies, and the DJI integration stays Beta because it has not been validated against a live fleet.
Backups, patching, TLS renewal and capacity are yours. That is the cost side of sovereignty and it is real. Commissioning exists to hand those over deliberately rather than by accident — but after handover, the pager is yours.
Standards, with honest status
| Standard | What we implement | Verified | Status |
|---|---|---|---|
| ASTM F3548-21 | Strategic deconfliction against the InterUSS DSS — the uss_qualifier suites pass with zero findings above Low severity. | 2026-06-10 re-runnable: make uss-qualifier | GA |
| ASTM F3411 v19 / v22a | Remote ID Net-RID Service Provider + Display Provider, verified by the same InterUSS qualifier run. | 2026-06-10 re-runnable: make uss-qualifier | GA |
| JARUS SORA 2.5 | Full ground / air-risk methodology with the complete SAIL Table 4 — behaviorally pinned, not a lookup stub. | Every CI run tests/test_sora_sail_matrix_contracts.py | Beta |
| EUROCAE ED-269 | Geographical-zone lifecycle schema-validated against the ED-269 model. | Every CI run ED-269 schema contract tests | Beta |
| EU 2021/664 U-space | Mandatory U-space service coverage across the platform capability set. | Every CI run capability contract tests | Beta |
GA here means an independent qualifier signed the implementation off on the dated run named beside it. Beta means implemented and exercised, with structural rather than full behavioural test coverage. Preview means partially implemented and not suitable for a compliance argument.
Ask us something harder
If a claim on this page does not survive your inspection, that is a defect and we want the report. If a gap on it is a blocker for you, say so — several of them are on the roadmap precisely because customers named them.