Where we are, and what's on the roadmap.
Last updated: September 2026
Contact us for a detailed conversation. Join the private beta to put your priorities forward for what comes next on the roadmap.
| Domain | Status | Notes |
|---|---|---|
| Essentials — IAM · KMS (KeyRack) · audit · CSPM · Data Perimeter | Available now | Organisation hierarchy with department isolation; AWS-compatible policy language with resource-level policies and conditions; temporary credentials and service accounts; immediate session revocation. KeyRack: per-tenant HYOK with HSM, AWS KMS API. One tamper-evident audit chain across every service, receipts before execution. CSPM and a Data Perimeter. |
| Compute — VMs · GPU | Available now | Step 2 of the staged install. GPU instance flavours and local NVMe available today. Every action a first-class audit event. Encrypted root volumes under Essentials KMS, including HYOK tenant keys; deletion protection, soft delete, instance identity via metadata. The VM comes from the hypervisor; the governance and orchestration from Soverita. Coming next: Confidential VMs. |
| Storage — block · object · backup | Available now | Volumes on Ceph or StorPool — StorPool supported as a high-performance alternative to Ceph for block storage. S3-compatible object storage with full IAM integration and audit chain; existing AWS SDKs and application code work unchanged. Managed file shares. QoS classes, automated scheduled backup policies. |
| Networking — VPCs · security groups · DNS · load balancing | Available now | AWS-style route tables per subnet; cross-project VPC peering; deny-and-priority security groups enforced at host or subnet level — NACL-shaped guardrails; VPC-scoped private DNS with auto-registration; active-active, scale-out load balancing. Coming next: Private Endpoints. |
| Developer experience — API · CLI · Terraform · SDKs | Available now | White-label self-service portal — your brand, your client relationships. One API, one contract: the same conventions, error model, pagination and auth across every service and access interface. SDKs, a Terraform provider and a CLI that mirror the API exactly; AK/SK auth compatible with SigV4 tooling; every call in the audit trail. Tenants don't touch the OpenStack APIs. |
| Operations & observability | Available now | Billing, quotas, logs, traces and metrics per tenant in one console; tenant-scoped CMDB. Coming next: Operations Center — all intelligence in the same console — and the Agentic SOC. |
| Kubernetes — bring your own | Available now | Your distribution and containers deploy on the governed compute, with CSI and cloud-controller drivers that plug into Soverita's APIs. Bring your AI Factory today. |
| Containers — engine · registry · managed Kubernetes | In development | Container Engine Service for simple containers; Artefact Registry with image signing and CVE scanning inside the audit chain; fully managed Kubernetes on open CAPI/CCM/CSI interfaces, CNCF conformance suite. Today you can bring your own. |
| Data services & AI | In development | Managed databases and messaging fully integrated with Essentials and the IaaS services. Model serving, fine-tuning and data never leave the secure perimeter; every request audited. Today you can bring your own. |
| Multi-site & federation | Designed | Tenancy, identity and audit model designed for multi-site operation; cross-deployment federation sequenced with private-beta partners. |
Governance core — controls that make compliance operational
Security controls pre-configured and aligned to the frameworks that matter — ISO 27001, BSI C5, DORA, NIST CSF 2.0 today; PCI-DSS, GDPR, NIS2 and SecNumCloud views expanding. Identity governance, immutable audit trails, encryption management, network isolation, security posture monitoring. Not bolted on after the fact — built into the platform, running continuously, evidence generated automatically. Your security posture becomes provable.
Identity governance
Organisation hierarchy with department isolation, clearance levels, federated identity (OIDC/SAML), and fine-grained resource policies in the AWS-compatible policy language. Temporary credentials and service accounts for automation and agents; immediate session revocation.
Immutable audit trail
Per-tenant, tamper-evident, SIEM-exportable. Every action logged with cryptographic receipts — denials included — before it executes.
KeyRack — HYOK
Each tenant controls its own master encryption keys, in KeyRack or its own HSM. AWS KMS API, extended. Automated rotation, revocation and escrow policies.
Compliance controls
Pre-configured baselines aligned to ISO 27001, BSI C5, DORA, NIST CSF 2.0 — PCI-DSS and GDPR expanding. Continuous evidence collection; one evidence base, many framework views.
Data perimeter
A boundary around every tenant's data: policies that define where data may be accessed from and by which principals, enforced on every request — so a leaked credential outside the perimeter cannot reach inside it. Certificates, secrets and TLS are managed underneath.
Security posture
Continuous misconfiguration detection. Framework rules evaluating against the standards you target — and, in progress, the Agentic SOC working the findings.
Every service, inside the governance envelope. A sovereign cloud is only as strong as its weakest module.
Developer experience — one API, one CLI, one Terraform provider
The infrastructure underneath may have inconsistent interfaces, different API conventions per service, and operational quirks that take years to learn. Soverita presents a unified facade — every service follows the same API conventions, the same error model, the same pagination, the same authentication. Learn how volumes work, and you already know how VPCs, instances and databases work.
For the technical team
Build once, deploy everywhere. Smithy-generated SDKs in Go and Python. OpenAPI specs for every endpoint. Terraform provider with full resource coverage. A CLI that mirrors the API structure exactly. AK/SK authentication compatible with existing SigV4 tooling; OIDC/SAML federation. Your CI/CD pipelines connect without rework — the interface is designed for automation, not for clicking through a portal.
Terraform provider · Go SDK · Python SDK · CLI (sova) · OpenAPI specs · AK/SK auth · SigV4 · IMDSv2
For the business
Faster delivery. Fewer errors. Less training. Consistent interfaces mean your team learns one set of patterns, not a different API for each service. Onboarding takes days, not months. Automation removes manual provisioning errors. Infrastructure-as-code means your environments are reproducible, auditable and version-controlled. Every action through the API lands in the audit trail — compliance evidence generated as a side effect of normal operations.
Self-service console · IaC export · Audit-by-default · Consistent UX · Reproducible environments
What "available" means in practice
Real virtual machines with their own lifecycle and placement — not pods on a Kubernetes substrate — with governed networking, storage and keys around them. Tenants get primitives engineered for the workloads they bring, and never see vanilla OpenStack.
Connectors
OpenStack — supported today, SCS-conformant OpenStack preferred. OpenNebula — proof of concept available. vSphere, Proxmox, CloudStack — on the connector roadmap; the sequence is set with our private-beta clients, whose substrates decide what we build next.
This page is deliberately unexciting.