Version 1.0.0 · Windows

Sovereign Security

Security software that works on your machine, for you, and tells you the truth about what it cannot do.

£5 a month See the hub
No accountNo trackingNo cloud consoleYour data never leaves
Everything happens on your computer. Your scan results are never sent anywhere, because there is nowhere to send them.

There is no account to create, no profile and no cloud console. It reaches out to keep its threat data and its updates current, to a published list of addresses and nothing else, and none of what leaves is about you or what it found. Sovereign Security is not an antivirus with extras bolted on. It is a security hub: the things a careful person would do by hand, given buttons.

Fourteen background modules, a five stage download pipeline, a local encrypted vault, a browser extension that does real work, and a maintenance suite that puts a button on the things Windows made you type.

v1.0.0 finished · Windows 10 and 11

The secure pipeline

Every download passes five stages before it reaches you, and every stage shows its working. Verdict, score and reasoning, written into the file's record.

No size limit

Not "up to 500 MB". A 27 GB file is read in full. A scanner with an exemption is telling an attacker its exact size.

Fourteen modules

Each runs as its own process, each switches on and off individually. USB holding, memory watching, DNS, honeypots, outbound whitelists and more.

A vault only you can open

Local, encrypted credential storage with breach checking that needs no lookup. There is no recovery, and we say so before you set one up.

A real browser extension

Chrome, Edge and Firefox. Ad and tracker blocking, a fingerprint shield with a before and after readout, and download checking before the transfer starts.

"Could not check" is never "clean"

Every check that cannot see something says so, rather than reporting a pass. It is a written rule in our codebase, and it has caught real bugs in our own product.

The hub

Fourteen modules, one window, every switch in your hands.

Sovereign Security
Sovereign Security modules interface

Border security, local monitoring, foundations and device control. Nothing is switched on behind your back, and the live log shows what each module is doing while it does it.

The secure pipeline

Every download goes through five stages before it reaches you.

Most products tell you a file was checked. This one tells you what was checked, at every stage, and joins the reasoning to the full report.

01

Intercept scan

The file is hashed and checked against a local database of over a million known bad signatures. Executables get heuristic analysis.

02

Holding bay

The file is held, not delivered, and scanned again. That catches anything that changes itself after landing.

03

Extraction

Archives are opened in memory and never written to disk, with limits on entry count, entry size, total size and compression ratio.

04

Analysis

Deep static examination, with the verdict and the reasoning recorded rather than summarised into a single word.

05

Approved

Released to a separate folder, and only then. Nothing reaches your download folder until it has been through all five.

It catches the tricks

Double extension traps, ransomware file extensions, polyglot files such as a ZIP wearing a .jpg, and EICAR test files, which are named as tests rather than raised as alarms.

Signatures are a discount, not a clearance

A valid code signature lowers the score. It does not end the check, because stolen certificates are a real thing.

Images are read, never run

Data hidden after the format's end marker, payloads in description fields, block lengths running off the end of the file. Measured: 62 real images, none flagged. 7 real polyglots, all 7 caught.

Fourteen background modules

Each runs as its own process. Each switches on and off on its own.

Secure Pipeline
The five stage download chain above.
Threat Database
Over a million known bad hashes, updated daily.
Defence Bridge
IP watchdog and outbound threat checking.
Device Guardian
Holds every USB device until you allow it, then watches what flows through it afterwards.
Memory Watcher
Scans new processes as they launch, and sweeps every 10 minutes.
Behaviour Monitor
Round the clock process behaviour, including dormant payloads that wake later.
Outbound Monitor
A per program outbound whitelist.
DNS Monitor
Query monitoring and algorithm generated domain detection.
Software Watcher
Silent install detection.
Honeypot Monitor
Decoy credential files that raise an alarm the moment anything touches them.
File Sweep
New and changed files, every 5 minutes.
Connection Block
Refuses known malicious addresses outright.
Port Watch
Notices closed ports being reopened.
Sentinel Collector
A local system baseline, rotated daily, that never leaves the machine.

Lockdown

One button cuts this machine off the network. It is red in every single theme, and it is the one thing you cannot recolour, because the button that stops everything should never be a colour you have to think about.

Scanning, the vault, the browser

The work you would do by hand, if you had the time and the patience.

Scanning

  • Full system scan. Every file, with an incremental mode that makes the second scan minutes rather than hours without skipping anything.
  • Persistence scan. The places malware hides to survive a restart: Run keys, startup folders, scheduled tasks, services, Winlogon hooks and WMI subscriptions.
  • Browser extension audit. Chrome, Edge and Firefox, with what each extension can actually see.
  • Browser hijack detection. Search engines, homepages, shortcut targets and proxy settings, checked outside the browser profile where profile only tools do not look.
  • Quarantine. Encrypted so it cannot run, with a rollback ledger so anything can be put back.

The vault

  • Local and encrypted. A password and credential store that stays on your machine.
  • Password generation and per entry capture checks.
  • Breach checking, two ways. Against a bundled list of around 900 breached sites with no lookup at all, and optionally against Have I Been Pwned for passwords using k anonymity: five characters of a hash leave, never the password.
  • A change password flow and a nuke option.
  • There is no recovery. The key comes from your password and exists nowhere else. That is the trade for a vault nobody else can open, including us.

The browser extension

  • Ad and tracker blocking from signed local lists.
  • Fingerprint shield. Per site, per session noise injected into the page's real APIs, with a before and after uniqueness readout. Login domains are excluded, because breaking sign in is not privacy.
  • Cross site linkability readout. Whether two sites could recognise you as the same person.
  • WebRTC leak protection, tested in the page rather than in the popup, because the popup is not where the leak happens.
  • URL un-shortener that says the price out loud: you cannot know where a short link goes without asking, and asking is a visit. Nothing resolves automatically.
  • Download checking before the transfer starts, so a known bad file never touches your disk.
Maintenance

A button for something Microsoft made you type.

Every tool here already ships with Windows. Most people do not know they exist, and end up downloading dubious third party cleaners instead.

Disk

  • Optimisation that knows what your drive is. TRIM for solid state, defragment for spinning disks, and it refuses to touch a drive it cannot identify, because defragmenting an SSD wears it out for no benefit whatsoever.
  • Free up space. Real measured figures, nothing ticked for you, and every category tells you what removing it actually costs. The two irreversible ones say so in capitals.
  • Vaporise a file or folder. Overwrite, rename, delete, then tell you everywhere it might still exist: cloud folders, backups, shadow copies. No Recycle Bin, no undo, needs your authorisation code, and it refuses anything Windows needs.

Repair and apps

  • Repair tools for sfc, DISM component store, chkdsk, memory diagnostic and network stack reset, with restore points as the safety net and a change ledger that can be undone.
  • Apps on two axes at once. What it is (bundleware, telemetry, updater, unknown) and whether it is safe to remove plus what removing it costs you. An app with no verdict reads "not assessed" and can never drift into "safe to remove".
  • Install tracing. Take a picture of your machine before you install something and another afterwards, and see exactly what is different: startup entries added, startup entries rewritten, programs, folders. It only looks. It has no button that deletes anything.
  • Software and privacy. Update auditing, silent install detection, telemetry domain blocking and old file review.

Health, home and reports

  • Drive health with four honest states and no percentage. A drive that reports no problem is described as not reporting any problem, never as healthy, and a drive we cannot read says so instead of going green.
  • Battery wear and thermals, where the temperature tells you where it came from, because a figure averaged across chipset, ambient and battery does not deserve a CRITICAL badge.
  • Vulnerable driver detection. Six known bring your own vulnerable driver families, what each one allows rather than the word "dangerous", what installed it, and how to get rid of it.
  • Your network, not just this machine. Discovers devices, holds unknown ones for you to decide about, and never leaves the house. Your router is on your network; talking to it is not an internet connection.
  • Reports with a limitations section. What this scan could not see, on every report, plus a reviewed tickbox so a report you have read looks different from one you have not.
Make it yours

Twelve themes, near total colour control, and a checker that tells you when you have made it worse.

Yours to shape

  • Twelve built in themes. Contrast, forest, ink, midnight, mist, paper, plum, rose, sand, slate, steel and terminal.
  • Near total colour customisation, across every element, orbs, toggles and fonts.
  • Per area text sizing. Not one blunt slider. The live log and the settings panels size separately from the headings, so you can make the part you actually read bigger without wrecking the layout.
  • Fonts are bundled, not fetched. The interface contacts nothing to draw itself.

A contrast and colour blind checker, built in

  • It tests your own colour choices against WCAG contrast ratios and the three common types of colour vision deficiency.
  • It warns you when two status colours would be indistinguishable, which is the moment a security interface stops working for you.
  • We have not found another security product that does this.
The rule we build to

"Could not check"
is never "clean".

Every check that cannot see something says so, rather than reporting a pass. It is a written rule in our codebase, it has caught real bugs in our own product, and it is the reason every report carries a limitations section describing what the scan could not see. Most products do not have one.

The things nobody else says

Seven commitments, and none of them are marketing.

No account in the product

No login, no profile, no password to recover. Your licence key is checked on your machine, against a key we ship, with no activation call. We do not even hold your billing details. Those sit with the payment provider and never touch our systems, and we hold nothing about your computer, your files, or what the software found.

A privacy policy enforced by a build gate

If our code reaches an address the policy does not name, the release is refused. Not a promise, a check that runs before we can ship.

We never brick your machine

Miss payments and scanning keeps working. Nothing is enforced on your computer, because nothing needs to be.

The price you join at is the price you keep

No first year discount that triples on renewal. Your price holds for the life of your subscription, including through v2.0.0.

Monthly costs the same as yearly

Everyone else charges more per year to the people who could not find the lump sum. We do not.

The same price in every country

No regional pricing, so there is nothing to arbitrage with a VPN, and no reason for our checkout to know where you are.

What it does not do

We publish this because a comparison table that leaves it out is marketing.

This is the same product that puts a limitations section in its own reports.

So here is the list, in full, before you pay for anything. Some of it is coming. Some of it is a decision we have made and do not intend to reverse.

Not in v1.0.0 · coming in v2.0.0
  • No kernel driver. No on access scanning at the filesystem layer, and no tamper protection.
  • It does not replace Windows Defender. The two run alongside each other, and that is deliberate for this release. Replacing Defender needs the driver and independent lab certification.
  • Behavioural detonation is switched off. Windows 11 hands console windows to Windows Terminal, a program already running that our sandbox did not start, so no boundary of ours can reach it. Rather than risk a malware window appearing on your screen, we refuse to run it and analyse it statically instead. The other pipeline stages are unaffected.
  • No CCTV features. Planned, and they need the hardware.
Deliberately not built
  • Parental controls and site filtering are stood down. Not "coming soon", a decision. They cannot be delivered honestly through the Windows hosts file, and doing them properly needs the router. We would rather ship nothing than ship a filter that quietly does not work.
  • No theme import or export. It would mean loading an untrusted file straight into a stylesheet, and we are not doing that in a security product.
  • The vault cannot be recovered. By design, and we tell you before you set one up.
Scope and platform
  • Windows only. Linux and macOS are scoped, not written.
  • The VPN is a separate add on. Ticked at checkout and priced on its own, because bandwidth is a real per user cost and we would rather charge for it honestly than hide it in everyone's subscription.
  • One feature contacts a third party. The speed test uses Cloudflare, it is disclosed right beside the button, and it does nothing at all until you press it.
The add on

A VPN, for the people who want one.

Some people want a VPN and some people do not, so it is not in the price. Tick it at checkout, or leave it, and nothing about the rest of the product changes.

Optional add on

Sovereign VPN

Priced on its own, added at checkout, and removable the same way. Bandwidth is a real per user cost, so we charge for it honestly rather than hiding it in the subscription of everyone who never switches it on.

£5 a month on top. Brazil only, because Brazil sits outside the Five, Nine and Fourteen Eyes agreements.

Standalone

Without the rest

The VPN is also sold on its own, for anyone who wants the tunnel and nothing else. Same coverage, same terms, and the same zero data collection: there is nothing held on you, so there is nothing anyone can ask us for.

£5 a month standalone. More on the VPN

Price

One price, everywhere, for as long as you stay.

£5 / month

or £60 a year. The same either way, because charging the monthly payer more is a tax on not having the lump sum.

Locked for lifeThe price you join at is the price you keep, including through v2.0.0.
Same worldwideNo regional pricing, nothing to arbitrage, and no reason for checkout to know where you are.
VPN priced separately£5 a month on top, ticked at checkout if you want it, ignored entirely if you do not.

Windows 10 or Windows 11. Some features, such as drive health and containment, read more when run with administrator rights, and say so when they cannot.