SecureLLMFirmin Labs
Back to summary
Canadian Sovereign Alternative · Companion analysis

Replacing the AWS layer with Canadian-owned infrastructure

Region of record: Canada (Quebec / British Columbia), Canadian-owned facilities Status: For architecture review — a sovereignty-first alternative to the AWS Bedrock design Companion documents: Executive Summary · Technical Implementation Blueprint · Alternative Platform (OpenAI) Analysis · References & Sources
Reader's note.

This document evaluates replacing the AWS Bedrock layer of the main proposal with Canadian-owned infrastructure and a Canadian-owned model. Provider capabilities, capacity rankings, and availability in this fast-moving market change quickly; every provider-specific claim here should be re-confirmed directly with the provider before procurement. No pricing is quoted because sovereign GPU capacity is sold as reserved compute or early-access serverless inference, not published per-token rates — treat cost as a commercial negotiation, not a list price.

1. The distinction that drives this document: residency vs. ownership

The main proposal pins data to AWS's ca-central-1 (Montreal) region. That delivers data residency — the data physically stays in Canada. It does not deliver sovereignty — AWS is a US-owned company and therefore falls under the reach of the US CLOUD Act, which can compel a US provider to produce data regardless of where it is stored. For most regulated Canadian workloads, residency is sufficient. For the subset where foreign-government legal access is itself the threat model — certain government, defence, critical-infrastructure, and highly sensitive financial or health workloads — only Canadian ownership closes the gap.

This document is for that stricter bar. It answers: can we keep the same security architecture and user experience, but run it on infrastructure that no foreign government can compel?

2. The hard constraint — and the Canadian upgrade that resolves it

The constraint. Anthropic's Claude and OpenAI's GPT-5.6 are only offered as managed services on the three US hyperscalers (AWS Bedrock, Google Vertex AI, Azure AI Foundry). Anthropic does not release Claude's model weights, so Claude cannot run on any Canadian-owned provider. The moment Canadian ownership becomes a hard requirement, Claude and GPT-5.6 leave the table. There is no swap that keeps the frontier US model and only changes the data-center owner.

The upgrade. This does not mean dropping to second-rate open-weight models. Cohere is a Canadian-owned (Toronto-headquartered) AI company whose Command family of enterprise LLMs is purpose-built for regulated, retrieval-heavy enterprise work, and — critically — Cohere supports private VPC and on-premise deployment, not just SaaS. Cohere models are already being deployed on Canadian sovereign infrastructure (the Bell AI Fabric / Cohere / Hypertec / BUZZ HPC partnership). This means a fully sovereign stack can be Canadian-owned at both layers: a Canadian-owned model (Cohere) running on Canadian-owned compute (TELUS, Bell/Hypertec, or the ThinkOn consortium). Open-weight models (Llama, Mistral, OpenAI's open-weight gpt-oss) remain a fallback where a Cohere licence is not preferred.

What you give up honestly: the native Claude desktop application is built around Claude's own API and features; it is not a general client for arbitrary models. A truly sovereign, non-Claude deployment therefore also changes the client — you would use Cohere's own secure agent platform (North), or an enterprise/OpenAI-compatible desktop client, rather than the Claude desktop app. You keep the security architecture pattern (locked-down managed client → private network → model in a Canadian-owned data center, with customer-held keys and full audit) — you do not keep the Claude app or the Claude model.

3. Recommended sovereign stack

LayerAWS Bedrock design (main proposal)Canadian sovereign design (this document)
ModelClaude 3.5 Sonnet (US-owned, Anthropic)Cohere Command (Canadian-owned) — or open-weight (Llama/Mistral/gpt-oss)
Model hostingAWS Bedrock, ca-central-1TELUS Sovereign AI Factory (Canadian-owned) — GPU-as-a-Service or Serverless AI
Desktop clientNative Claude desktop app (3P/Bedrock mode)Cohere North, or an enterprise/OpenAI-compatible managed client
Private networkAWS PrivateLink / VPC endpointProvider private interconnect / dedicated VPC within the sovereign environment
EncryptionAWS KMS customer-managed keyCustomer-managed keys held by the organization (confirm provider KMS/BYOK support)
IdentityAWS IAM Identity Center → corporate IdPCorporate IdP (Entra ID / Okta) → gateway/client SSO
AuditCloudWatch + S3 in ca-central-1Organization-controlled logging within the sovereign environment
ResidencyCanada (Montreal)Canada (Quebec / BC)
Ownership / CLOUD Act exposureUS-owned — exposedCanadian-owned — not subject to US CLOUD Act

4. Featured provider: TELUS Sovereign AI Factory

Among Canadian-owned providers, TELUS Sovereign AI Factory is the recommended default for a turnkey enterprise deployment today, because it is the one that is simultaneously in production, productized for business, and operating at scale:

  • Operational now. TELUS describes it as Canada's first fully sovereign AI Factory, live in a Tier III, LEED Gold-certified facility in Rimouski, Quebec, and reports it as ranked the fastest and most powerful system in Canada (TOP500). Its first capacity sold out, and TELUS is expanding with three additional high-performance data centres in British Columbia.
  • Canadian-owned, CLOUD Act-exempt. TELUS states that 100% of data processing and storage remains within Canadian borders and that, as TELUS Communications Inc. is Canadian-owned, it is not subject to the US CLOUD Act, and that the service is PIPEDA-compliant. This is the specific property the AWS design cannot provide.
  • Enterprise-grade compute. Exclusively NVIDIA H200 GPUs (141 GB HBM3e, 4.8 TB/s bandwidth), offered as GPU-as-a-Service (dedicated capacity for fine-tuning and inference via GPU VMs, Kubernetes, or bare metal) and Serverless AI (API-driven, pay-per-token inference — currently waitlisted). TELUS also offers deployment support and its own generative-AI platform (Fuel iX).
  • Proven workflow track record. A productized "Sovereign AI Factory for business" with paying, sold-out customers and hands-on deployment support is exactly the "proven record of setting up this type of workflow" the evaluation calls for.

Credible alternatives to validate in parallel (the sovereign market is expanding fast and "most capacity" is a moving target):

  • Bell AI Fabric + Hypertec + BUZZ HPC + Cohere — a landmark partnership putting NVIDIA Grace Blackwell capacity on Canadian soil (a reported ~US$220M GPU contract), pairing Canadian-owned infrastructure with Cohere's Canadian-owned models. Strongest raw-capacity and model-aligned play; more infrastructure/wholesale in shape.
  • ThinkOn + Hypertec + Aptum + eStruxture — "Canada's first end-to-end sovereign, AI-ready cloud," all Canadian-owned, currently government-focused. Strong for an all-Canadian supply chain from colocation to managed cloud.

Recommendation: feature TELUS as the operational anchor and run a short parallel due-diligence on Bell/Hypertec for capacity and on Cohere for the model licence, then let a scored pilot decide.

5. Technical write-up: how it is accomplished on TELUS Sovereign AI Factory

This section maps the AWS architecture, one component at a time, onto the TELUS sovereign environment with a Cohere model. The security pattern is identical to the main blueprint; the owners and services change.

5.1 Target architecture (data flow)

Sovereign inference data-flow diagram A managed desktop client — Cohere North or an enterprise/OpenAI-compatible client — on an employee desktop sends requests over a private interconnect, never the public internet, into the TELUS Sovereign AI Factory in Rimouski, Quebec, a Canadian-owned facility. Inside that sovereign tenancy, a private inference endpoint routes the request to Cohere Command running on a dedicated VPC with NVIDIA H200 GPUs, protected by customer-held keys and organization-controlled audit logs. The response returns over the same private path. Employee desktop Managed client Cohere North / OpenAI-compatible private interconnect no public internet response TELUS SOVEREIGN AI FACTORY — RIMOUSKI, QC (CANADIAN-OWNED) Private inference endpoint org VPC / tenancy Cohere Command VPC / dedicated GPU · H200 Customer-held keys · organization-controlled audit logs held by the Canadian organization, inside the sovereign tenancy
Not in the data path / no legal reach
  • Anthropic
  • OpenAI
  • AWS / Google / Azure
  • The public internet
  • Any US-owned entity
  • US CLOUD Act jurisdiction

5.2 Component-by-component build

Model serving (replaces AWS Bedrock). Two supported paths:

  • Managed Cohere on sovereign infra — deploy Cohere's Command models into a private tenancy on TELUS GPU-as-a-Service (or via Cohere's VPC/on-prem deployment option running on the sovereign GPUs). The organization gets a private inference endpoint; no request leaves the Canadian-owned environment. This keeps a Canadian-owned, enterprise-grade model with minimal MLOps.
  • Self-hosted open-weight — serve Llama, Mistral, or gpt-oss with a standard inference server (vLLM or NVIDIA NIM/TGI) on dedicated H200 capacity. Maximum control and no model licence, at the cost of running the serving stack yourself (scaling, batching, evals, patching).

Desktop client (replaces the Claude desktop app). Because the Claude app is Claude-specific, use Cohere North (Cohere's secure enterprise agent platform, deployable privately) as the sanctioned client for a Cohere stack, or an enterprise/OpenAI-compatible desktop client pointed at the private endpoint for an open-weight stack. Whichever client is chosen, apply the same lockdown discipline from the main blueprint: centrally managed configuration via MDM (Intune/Jamf), disabled data-exfiltration surfaces (arbitrary plugins, shell/tool execution), an egress allow-list limited to the private inference endpoint and corporate IdP, and read-only enforced policy so users cannot repoint the client.

Private network (replaces AWS PrivateLink). Connect corporate egress to the TELUS sovereign environment over private interconnect / dedicated tenancy rather than the public internet — provider-private networking, a dedicated VPC, or a private circuit (e.g., dedicated fibre / cloud interconnect) into the Rimouski facility. Confirm the exact private-connectivity product with TELUS; the requirement is that inference traffic never traverses the public internet and terminates only inside the sovereign tenancy.

Encryption / key custody (replaces AWS KMS). Hold customer-managed keys for data at rest (model context caches, logs, any stored transcripts) and enforce TLS in transit on the private path. Confirm the provider's BYOK / customer-managed-key support and, for the highest assurance, an HSM option under the organization's control. The sovereignty guarantee is strongest when the keys are held by the Canadian organization, not the provider.

Identity & attribution (replaces IAM Identity Center). Federate the client/gateway to the corporate IdP (Microsoft Entra ID or Okta) so every request is attributable to a named user. Keep authorization least-privilege and scoped to inference.

Audit & retention (replaces CloudWatch/S3). Log requests and access to an organization-controlled store inside the sovereign environment, encrypted under customer keys, with a defined retention lifecycle. As in the main blueprint, decide deliberately whether full prompt/response bodies or only metadata are logged, since logs of sensitive data become a second store to protect.

Governance guardrail (replaces the AWS Organizations SCP region lock). The SCP region-lock has no exact equivalent outside AWS; its intent — make it impossible for a request to be served outside the sovereign boundary — is met structurally here, because the private endpoint, the model, and the compute all live inside a single Canadian-owned tenancy with no cross-border failover configured. Document this as the residency/sovereignty control and test it (see §7).

5.3 High-level deployment steps

  1. Commercial + due diligence. Engage TELUS Sovereign AI Factory (GPU-as-a-Service or Serverless AI); confirm capacity/lead time, private-connectivity product, BYOK/customer-managed-key support, and contractual Canadian-ownership / no-CLOUD-Act representations. Engage Cohere for a Command licence and private-deployment terms (or select an open-weight model).
  2. Provision the sovereign tenancy. Stand up dedicated H200 capacity (or the private serverless endpoint) and the private interconnect from corporate network to the Rimouski facility.
  3. Deploy the model. Stand up Cohere Command in the private tenancy (or serve the chosen open-weight model with vLLM/NIM), exposing a single private inference endpoint.
  4. Deploy and lock down the client. Roll out Cohere North / the enterprise client via MDM with the lockdown profile (managed config, disabled exfiltration surfaces, egress allow-list, read-only policy).
  5. Wire identity, encryption, and audit. Federate to the corporate IdP, enable customer-managed keys, and point logging at the org-controlled store.
  6. Validate and pilot. Run the residency/sovereignty control tests (§7) and a scored quality pilot against the Bedrock/Claude baseline before scaling.

6. Trade-offs vs. the AWS Bedrock design

DimensionAWS Bedrock + Claude (ca-central-1)TELUS Sovereign + Cohere
Data residency (in Canada)YesYes
Canadian ownership / CLOUD Act protectionNoYes
Model qualityFrontier (Claude 3.5 Sonnet)Strong enterprise-grade (Cohere Command); open-weight as fallback — evaluate fit per workload
Desktop experienceNative Claude app, turnkey lockdownCohere North / enterprise client — capable, but a different product to configure
Managed vs. self-runFully managed, minimal MLOpsManaged (Cohere-on-sovereign) to self-run (open-weight) — more operational ownership
Cost shapePer-token, ~97% variable, low fixedReserved GPU capacity or early-access serverless — higher fixed commitment, negotiated
Capacity availabilityOn-demand, matureStrong but finite; sold-out cycles and waitlists — plan lead time
Ecosystem maturity (non-gov enterprise)MatureEmerging and expanding rapidly
Time to deployWeeksLonger — commercial negotiation + tenancy provisioning + client change
One-line framing for the site.

Choose the AWS design when Canadian residency is the requirement and you want the frontier model and fastest rollout; choose the sovereign design when Canadian ownership — protection from foreign-government legal access — is the requirement, and accept a capable Canadian model, a different client, and a heavier commercial and operational commitment in exchange.

7. Sovereignty-specific risks and controls

  • Model-quality gap. Cohere Command and open-weight models are strong but differ from Claude on some tasks. Control: scored pilot on real workloads before committing; keep the model swappable behind the private endpoint.
  • Operational burden (open-weight path). Running your own inference stack adds scaling, patching, and evaluation work. Control: prefer the managed Cohere-on-sovereign path unless there is a reason to self-host; budget MLOps capacity if self-hosting.
  • Capacity and lead time. Sovereign GPU capacity sells out and is often waitlisted. Control: reserve early; secure contractual capacity and lead-time commitments.
  • Key custody = the sovereignty linchpin. If the provider holds the keys, the ownership guarantee weakens. Control: insist on customer-managed keys / BYOK (HSM-backed if available) held by the organization.
  • Verify the ownership claim contractually. "Not subject to the US CLOUD Act" must be a contractual representation, validated by legal, not a marketing line — including subprocessors, the model vendor, and any hardware/software support paths. Control: legal review of the full supply chain (provider, model vendor, GPU/software support).
  • No SCP-equivalent guardrail. Outside AWS you lose the declarative region-lock. Control: structural containment (single sovereign tenancy, no cross-border failover) plus a scheduled control test confirming no egress leaves the sovereign boundary and all inference terminates in-tenancy.
  • Endpoint security still applies. As in the main blueprint, this protects the inference path, not the laptop. Control: device encryption, EDR, MDM, and DLP remain prerequisites.

8. References

Accuracy note for publication.

Provider status, capacity rankings, and availability change quickly. Before publishing to the SecureLLM site, re-verify each provider claim (especially "most powerful/TOP500," "sold out," GPU generation, and the CLOUD-Act representation) against the primary source, and present capacity/ranking statements as "as reported by the provider" where they originate from provider announcements rather than independent benchmarks.

Back to summary