Entrazure
What Novarque is
Novarque is a named offer inside Entrazure Technologies. It is not a separate company, not a subsidiary and not a partner firm. The same engineers deliver it, under the same two legal entities, on the same contracts. The name exists because sovereignty work is bought by a different person than a migration, usually a CISO, a data protection officer or a director general, and because that person asks questions in regulatory language rather than in Azure service names.
The offer covers three things and refuses a fourth.
Sovereignty architecture. Where regulated data rests, which legal system reaches the operator holding it, who controls the encryption keys, and what is written down so that a security review can verify the answer instead of taking it on trust.
Loi 25 and NIS2 readiness at the architecture layer. Not a policy document that describes a system nobody built. Controls enforced by Azure Policy, identity design and pipeline gates, with the evidence exported rather than assembled by hand.
Exit paths. The documented, costed and rehearsed route off a hyperscaler or a managed platform. An exit clause in a contract is not an exit path. An exit path has a runbook, a data format, a target and a number of weeks attached to it.
What we refuse: we are not a hosting provider, we operate no cloud of our own, and we do not certify anyone’s sovereignty. No consultancy can. We design the properties, build them as code, and hand over the evidence. The regulator, the auditor or your customer’s security team draws the conclusion.
The four questions sovereignty reduces to
Where does the data rest? This is the only one most organizations have answered. It is enforced properly by region restriction in Azure Policy, assigned at the management group level so every future subscription inherits it, which is part of what an Azure landing zone is for. A region chosen in a portal dropdown by whoever created the subscription is not a residency control.
Which legal system reaches the operator? Physical location and legal jurisdiction are different questions, and conflating them is the single most common error in sovereignty conversations. A datacentre in Quebec run by a US-headquartered operator sits inside a different legal reality than the postcode suggests. We write that reality down, name the specific instruments that apply, and let you decide which workloads can live with it. Most can. Some cannot, and knowing which is the point.
Who holds the keys? Customer-managed keys in Azure Key Vault or Managed HSM change the answer materially, and we are precise about what they do and do not prevent. Key custody is a real control with real operational cost, including the failure modes nobody rehearses until the day the key is unavailable.
How long would it take you to leave? Measured in weeks, with a named target and a tested procedure. This is where the VMware exit work and sovereignty work meet: an organization that has already been trapped by one platform asks this question first.
Loi 25 and NIS2, translated into architecture
Loi 25 reads like a privacy statute and describes an architecture. Know where personal information lives. Justify any transfer outside Quebec with a privacy impact assessment. Produce or delete an individual’s records on request. Detect and report a confidentiality incident. Each of those maps to something concrete: a data inventory, a region policy, a retention design, logging and alerting. The detail is in Loi 25 and data residency, and the control work sits inside compliance architecture.
NIS2 adds supply chain accountability, incident reporting on a short clock, and personal management responsibility for organizations with European operations. Where health data is involved, HDS hosting requirements apply on top. Both are covered under GDPR and HDS.
What sits under this offer
Sovereignty architecture is the main page: the design work, the exit path, and what we produce at the end.
Klarvant is a third-party namespace and digital territory intelligence product that Entrazure resells and operates as an MSSP. It is not our product and not a brand of ours, and the page says so plainly.
The identity half of this work, conditional access, Privileged Identity Management, access reviews and workload identity, lives in cybersecurity and Entra ID. Sovereignty claims collapse fastest at the identity layer, because standing administrative access from anywhere makes every residency control decorative.
Who this is for
Regulated enterprises and public bodies in Quebec, the rest of Canada, and organizations with European operations, where a residency or jurisdiction commitment has been made to a regulator, a board or a customer, and someone now has to demonstrate it. Also organizations whose own clients have started writing residency clauses into contracts, which in healthcare is now routine rather than exceptional.
Who this is not for
If sovereignty is required as a marketing line rather than an architectural property, we are the wrong firm: everything we produce is verifiable, which cuts both ways. If the requirement is to eliminate all US-headquartered technology from the estate, say so on the first call, because that is a different program with a different budget and we will not pretend an Azure design satisfies it.
Where to start
With the two-week assessment: a written opinion on what exists and a ranked backlog with an honest cost against each item. Read about Entrazure if you want to know who is doing the work first.
Questions we get
Is Novarque a separate company?
No. Novarque is a named offer inside Entrazure Technologies. Same engineers, same contracts, same company. The name exists because sovereignty work is bought by a different person, usually a CISO, a DPO or a director general, and uses different vocabulary from a landing zone project. There is no second business, no separate P&L and no third party involved.
Can you certify that our architecture is sovereign?
No, and neither can anyone else selling you consulting. Sovereignty is not a certification, it is a set of properties: where data rests, who can legally compel access, who holds the keys, and how long departure would take. We design those properties in, enforce them as code, and produce the evidence. Your regulator, your auditor or your customer draws the conclusion.
Do you host the data yourselves?
No. We are not a hosting provider and we do not operate a cloud of our own. We design and build on Microsoft Azure, and where a workload genuinely cannot sit with a US-headquartered operator we say so plainly and scope the alternative, rather than pretending a Canadian region resolves a jurisdictional question.
Our data is already in Canada Central. Is that enough?
It answers one of the four questions and leaves three open. Region controls physical location. It does not control which legal system applies to the operator, who holds the encryption keys, or how long it would take you to leave. Those are separate design decisions, and most estates we look at have never made them explicitly.
Does this only apply to Quebec organizations?
No. Loi 25 is the sharpest driver in Quebec, NIS2 applies to organizations with European operations, and the same questions come from US healthcare and financial buyers under different names. The architecture work is the same. The framework language and the evidence format change.
Where does an engagement start?
With a two-week assessment of what exists, ending in a written opinion and a ranked backlog. We do not open with a remediation program, because the first two weeks routinely reorder the priorities the client arrived with.