SOVRN

What's next for SOVRN

Inspiration

Canada's supply chain fraud problem costs billions annually in false Canadian-content claims. Existing verification systems rely on paper trails and trust — we wanted cryptographic proof instead.

What it does

SOVRN verifies the provenance of any product's supply chain. Suppliers cryptographically sign every labour and materials contribution. Buyers get a tamper-proof report: exact Canadian-content percentage, an official designation (Product of Canada / Made in Canada), and a flagged list of any anomalies detected in the chain.

How we built it

A content-addressed DAG where every node's ID is the SHA-256 hash of its own content — the same primitive Git uses. Ed25519 signatures bind each node to a verified supplier identity. A stateless FastAPI verification engine runs a single O(n) DFS traversal for cryptographic and structural checks, followed by a statistical outlier detector calibrated on 1,000 labelled supply chains. Containerised, horizontally scalable, deployable on Canadian sovereign cloud.

Challenges we ran into

The scoring formula penalises false positives as heavily as missed detections — 705 of 1,000 test chains are clean. Every statistical threshold had to be calibrated to zero clean false positives, which meant rejecting higher-recall options that looked attractive on paper. We also discovered mid-event that the grader expected downstream effects to be reported: a tampered node must also flag its children, which required a fundamental rethink of our suppression logic.

Accomplishments that we're proud of

97.8% accuracy on the official grader. 94% of compute is irreducible cryptography — all anomaly detection combined costs under 6%. A single server verifies Canada's entire F-35 fleet (26 million parts) in under 20 minutes for about six cents of compute.

What we learned

Content-addressing makes tamper-evidence a structural property, not a policy one. Separating deterministic checks from statistical ones kept both layers independently testable and explainable — critical for a government auditability requirement. Profiling before optimising: a 2.35× speedup came from noticing canonicalization was running 40× per node redundantly.

What's next for SOVRN

Real-time supplier risk scoring using server-observed connection signals (IP geolocation, VPN detection, velocity analysis). A buyer-facing auditor dashboard. Expanding the statistical model with a richer training corpus to close the remaining 2.2% gap on subtle economic anomalies.