Sovereignty Certificates are a draft industry specification for proving where a computing workload runs.
An agent inside a trusted execution environment exchanges signed messages with anchor servers at known locations and times the replies. Signals cannot travel faster than light, so each reply time caps the distance to that anchor. A verifier checks the hardware attestation and the timings, computes a feasible region and issues a short-lived certificate.
The specification is hosted by Lucid Computing and attributed to a working group. As of September 2026 it is still draft 0.1.0, dated October 2025, with no public implementation or measured results.
It trusts the hardware root of trust and the TEE, and leaves sophisticated physical attacks as a residual risk. Known attacks on delay-based location checks, such as faster network paths and compromised anchors, also apply.
A public draft states the claim and threat model, but nothing has been built or measured in public.
Assessed use: certifying the region where an attested workload ran at a given time
On this page
What it is
Sovereignty Certificates are a draft specification for "cryptographic credentials that provide verifiable, unforgeable proof of the physical location of a computing workload at a specific point in time", according to the repository README 1. The document is version 0.1.0, dated 2025-10-21, marked "Draft" and "Prepared by: Sovereignty Certificates Working Group" 1. It describes itself as an industry-led specification, not an official standard from a body such as ISO or IEC 1. It is licensed CC BY 4.0 1.
The specification applies delay-based location verification to computing devices such as CPUs and GPUs 1. Its repository sits in Lucid Computing's GitHub organization 1. The working group's website describes the group as an independent initiative 2. It lists participants by category, including chip makers, cloud providers, frontier AI labs and compute-governance organizations, without naming them 2. Lucid's homepage links to the effort and describes Lucid's own offering as attested, confidential-computing GPU clusters with data-residency controls 3.
How it works
The specification calls its method ping-based location attestation 1. Signals cannot travel faster than light, so a measured round-trip time gives an upper bound on the device's distance from each anchor 1. The specification describes the following steps 1:
- The verifier sends the attester a fresh nonce and a signed directory of trusted anchors.
- From inside a trusted execution environment, the attester probes several anchors chosen to give good geometry.
- Each anchor returns a signed receipt with a timestamp and the probe's nonce, and the attester records when each reply arrives.
- The attester bundles the receipts with a hardware attestation quote that binds a per-cycle key and the verifier's nonce to the platform.
- The verifier checks signatures, freshness and platform integrity, then runs a deterministic multilateration to compute a feasible region.
- The verifier issues a short-lived certificate stating the location, radius and confidence, and which policies passed.
Workloads must fail closed when a certificate expires 1. The specification argues that tunnels and VPNs add latency, so they generally cannot make a device appear closer to an anchor than it is, and usually produce geometrically inconsistent measurements 1. It requires rejecting evidence whose distance bounds have an empty or impossible intersection 1. Anchors should monitor each other's round-trip times, and an anchor that deviates from the physical baseline should be temporarily removed from the directory 1.