Copies of business data
Your live production data, a local on-premise backup appliance repository, and an air-gapped sovereign Canadian cloud repository.
- • Live production environment
- • Local Gigabit NAS appliance
- • Offsite Canadian cloud vault
Technical blueprint · defense architecture
The 3-2-1-1-0 framework & four defense pillars
Canada IT Pro delivers business continuity using an enterprise-grade architecture designed to eliminate single points of failure across storage media, physical locations, and verification routines.
Enterprise blueprint
Zero single points of failure
Built to address ransomware encryption, hardware failures, physical office disasters, and human error.
Different storage media
High-performance local enterprise network-attached storage paired with cloud-native S3 object storage for resilient cross-media survivability.
- • Enterprise hardware NAS
- • Cloud-native S3 object storage
- • Eliminates single-media corruption
Copy stored offsite
Replicated outside the local disaster radius to a Canadian facility in ca-central-1.
- • Canadian datacenter (ca-central-1)
- • Survives fires, floods, and theft
- • 100% Canadian data sovereignty
Copy immutable (air-gapped)
Protected by WORM policies at the local Btrfs filesystem layer and offsite S3 Compliance Mode Object Lock.
- • Local Btrfs WORM snapshots
- • S3 Compliance Mode Object Lock
- • Protection against ransomware and rogue admins
Restore errors confirmed
Verified through automated SHA-256 checksum scans and scheduled file restore testing to staging environments.
- • Daily SHA-256 checksum scans
- • Scheduled verified restore tests
- • Automated audit logs
Automated continuous pipeline flow
Step 1
Local WORM lock
Written to local appliance with AES-256 volume encryption and hardened Linux Btrfs immutable snapshots.
Step 2
Encrypted transit
Replicated over TLS 1.3 tunnels with Perfect Forward Secrecy to the Canadian cloud repository.
Step 3
S3 Compliance lock
Locked under a 30-day rolling Wasabi S3 Compliance Mode window; deletion requests are rejected at the storage layer.
Step 4
Hash verification
Automated SHA-256 checksums and scheduled file restore tests extract and validate sample files.
Core defenses
The four pillars of sovereign defense
The architecture is built around cryptographic isolation, immutable storage, and Canadian data residency.
Pillar 1
Cryptographic isolation & zero plain-text privacy
Data protection begins with confidentiality. The end-to-end cryptographic pipeline is designed to prevent plain-text exposure during transit or at rest.
- Volume-level storage encryption: AES-256-XTS protects data on the local appliance if hardware or physical drives are stolen.
- Client-side envelope encryption: Data is compressed and encrypted on-premise using a private AES-256 key before offsite transmission.
- Transport layer security: Replication uses TLS 1.3 tunnels with Perfect Forward Secrecy and SHA-256 hashing.
- Zero plain-text access: Technicians monitor infrastructure telemetry, storage capacity, and backup success metrics, not the contents of client records, tax working papers, or legal correspondence.
Pillar 2
Local hardware appliance & Btrfs filesystem immutability
Standard Windows file shares can be accessed and encrypted by ransomware using compromised administrative credentials. The separate local appliance isolates this attack surface.
- Dedicated on-premise appliance: Enterprise hardware runs a hardened, out-of-band Linux storage kernel separate from the corporate Windows domain.
- Btrfs filesystem WORM snapshots: Backup repositories are captured as scheduled, read-only snapshots under Write-Once-Read-Many rules.
- Malware resistance: The storage OS rejects modification and deletion commands targeting locked snapshots, even if domain administrator credentials are compromised.
- Local recovery: Backup data resides on the high-speed local network, avoiding the delays of downloading large datasets over internet connections.
Pillar 3
Air-gapped cloud protection via S3 Compliance Mode
Offsite protection is designed to survive physical site disasters such as fires, water damage, or theft.
- Canadian cloud repository: Encrypted backup streams replicate to the Canadian cloud object storage vault in ca-central-1.
- S3 Compliance Mode Object Lock: Wasabi S3 Object Lock in Compliance Mode is configured so retention cannot be bypassed, shortened, or overridden during the lock period.
- Rolling tamper-proof windows: Cloud data is committed under a rolling 30-day retention lock; deletion requests are rejected until retention expires.
- Engineered version rotation: Hyper Backup retention is set to 31 daily versions so rotation occurs after the 30-day object lock window.
Pillar 4
100% Canadian data sovereignty
Data residency is a critical legal and professional requirement for Ontario accounting and law firms.
- Strict national residency: Offsite repositories remain in Canada in ca-central-1; the source site states no data enters or passes through the United States.
- Canadian jurisdiction: Canadian residency is intended to reduce exposure to foreign extra-territorial laws, including the US CLOUD Act.
- Infrastructure durability: The source describes 11-nines data durability, redundant N+1 power, environmental suppression, and 24/7 biometric physical security.
Mathematical integrity
Verified file restore testing & integrity assurance
Automated verification routines and active file restore validation are intended to provide recovery readiness down to the SHA-256 hash level.
Automated block checksums
Backup jobs run SHA-256 block-level checksum scans. If storage media experiences silent bit rot or degradation, the source describes detection and repair from parity data.
Verified file restore testing
Scheduled restore tests place critical files, database components, and sample application archives into an isolated staging directory on the appliance.
Hash & structural comparison
Restored test files are compared against source checksums to confirm files decompress cleanly, maintain integrity, and remain readable.
Audit logs (CRA IC05-1R1)
Restore testing logs generate an auditable record of recovery validations, supporting electronic record readability and retrieval testing.
Specification
Technical parameters
Encryption at rest
AES-256-XTS volume encryption on local appliance
Encryption in transit
TLS 1.3 with Perfect Forward Secrecy
Cloud encryption
Client-side envelope encryption using AES-256 before transmission
Local immutability
Btrfs Write-Once-Read-Many filesystem snapshots
Cloud immutability
Wasabi S3 Object Lock in Compliance Mode
Retention schedule
GFS: 31 daily, 12 monthly, and 7 yearly points
Cloud lock window
30-day rolling S3 Object Lock with 31-day daily rotation
Cloud location
Canadian cloud storage, ca-central-1
Hardware
Enterprise appliance configured and maintained by Canada IT Pro
Specifications are reproduced from Canada IT Pro source material; actual configuration should be confirmed during assessment.
Ready to review the sovereign continuity standard?
Request an on-site hardware staging plan tailored to your Ottawa office. The dedicated appliance is included, deployed, and managed by Canada IT Pro.