Apertus SovereignGate

• 

  Apertus SovereignGate Operations Console — Live 3-pane telemetry displaying active CSCS Lugano model connectivity and zero-retention status.

• 

  Inbound Sanitization Airlock — Real-time masking of Swiss AHV-13, clinical data, and IBANs.

• 

  Deterministic Surrogate Vault — Isolated volatile session memory preserving structural grammar without exposing client lineage.

• 

  Dynamic In-Flight Context Restorer — Seamless rehydration of surrogate tokens into client records during streaming SSE responses.

• 

  Cryptographic FADP Audit Attestation — Tamper-evident SHA-256 compliance certificate satisfying Swiss revDSG and FINMA 2018/3 requirements.

• 

  Hardware Memory Shredder Benchmarks — Sub-millisecond (0.13 ms) throughput validation with native ctypes.memset null-byte zeroization.

Inspiration

What it does

How we built it

🇨🇭 Inspiration

Under Switzerland’s revised Federal Act on Data Protection (revDSG / FADP) and FINMA Circular 2018/3 (Outsourcing), Swiss private banks, financial institutions, and healthcare providers face personal executive liability of up to CHF 250,000 for unlawful cross-border disclosures.

While foundational models like Apertus 70B hosted at CSCS (Lugano) provide true Swiss sovereign intelligence, enterprise adoption remains blocked if internal systems inadvertently leak raw client identities over transit pipes. We built Apertus SovereignGate to eliminate this regulatory deadlock.

⚡ What It Does

Apertus SovereignGate acts as a high-performance reverse airlock proxy deployed inside the client's local perimeter:

1. In-Flight Surrogate Masking: Automatically intercepts Swiss PII (AHV-13 numbers, patient dossiers, IBANs, cantonal corporate IDs) and substitutes them with deterministic surrogate tokens (<SWISS_AHV_1>, <SWISS_CLINICAL_1>) before payloads hit remote compute endpoints.
2. Zero-Retention Hardware RAM Shredding: Does not rely on standard garbage collection. Volatile session lookup tables are zeroized at the byte level using native ctypes.memset immediately upon request completion (0 bytes retained).
3. Dynamic Context Restorer: Dynamically reconstructs the original context in-flight as the model's response streams back to the enterprise application.
4. FADP Cryptographic Audit Attestation: Generates downloadable, tamper-proof SHA-256 compliance audit certificates for cantonal and FINMA auditors.
5. Sub-Millisecond Overhead: Built on high-performance ASGI pipelines, adding only 0.13 ms (126.6 µs) latency overhead.

🛡️ Sovereign Deployability & Technical Rigour

• Zero External Boundary Leaks: Runs as an on-premise ASGI microservice or container within the client's local network perimeter. Unmasked identifiers never leave Swiss legal jurisdiction.
• Turnkey 1-Command Deployment: Completely containerized with health checks and hardened privileges via Docker Compose: ```bash docker compose up -d --build ## Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Apertus SovereignGate

Built With

• apertus-70b
• cscs
• cybersecurity
• docker
• docker-compose
• fadp
• fastapi
• finma
• python