GoSpinUp

Spin up a sovereign enclave,
a PQC audit, or a slop guard -
one at a time.

GoSpinUp turns the hardest enterprise compliance work - sovereign AI, audit evidence, post-quantum readiness - into fixed-scope services you can stand up one at a time. We call them Spins.

Browse the SpinsBook a scoping call

Founder-led · Fixed scope · Made in Canada

The next deadline doesn't move.

Three cryptographic gates, five months apart. The first one is the one people miss.

FIPS 140-2 SUNSET · 21 SEP 2026
--Days
--Hrs
--Min

After this date, FIPS 140-2 certificates move to Historical status — and stop supporting new federal procurement.

21 SEP 2026FIPS 140-2 sunset — certificates go Historical
10 NOV 2026CMMC Level 2 enforcement — FIPS-validated crypto for CUI
01 JAN 2027CNSA 2.0 acquisition gate — PQC required at procurement
/ The Spins

Seven services.
One way of working.

Start with the Spin your audit calendar needs first. Each one stands alone; together they share a boundary, a key hierarchy, and an evidence trail.

01-02AVAILABLE

ReignClave - the Sovereign Enclave

Sovereign AI

Frontier open-weight models deployed inside your enclave : air-gapped, VPC-native, or on a sovereign-cloud partition. Full custody, zero egress.

AI Compliance & Audit

Evidence packs and tamper-evident audit trails mapped to GC Cloud Guardrail, PIPEDA/CPA, NIST AI RMF, and SOC 2.

$ spin up reignclave
03COMING SOON

PQC Readiness Audit

Post-quantum cryptography inventory and migration mapping : find every classical key, certificate, and protocol before the deadline finds you.

$ spin up pqc-audit
04COMING SOON

Sovereign Agentic Platform

Tenant-isolated, jurisdiction-anchored agent systems with citations, eval harnesses, and drift monitors built in.

$ spin up agentic-platform
05COMING SOON

Data Residency Mapping

A control-by-control map of where your data and model artifacts physically live, and who can reach them.

$ spin up data-residency
06FREE · OPEN SOURCE

Slopguard CLI

Checks your manifests against the live PyPI and npm registries and catches AI-hallucinated packages before they ever reach your install.

No signupRuns in CI
Try it now
07FREE · NO SIGNUP

Compliance Deadline Calendar

Every FIPS, CMMC, CNSA, and EU AI Act date that applies to you — filtered by your industry, so you see the four that matter instead of forty that don't.

No signupFilter by industry
Open the calendar
08

Your next audit problem

New Spins come from what regulated teams ask us for. If your compliance calendar has a gap, tell us - it may become the next one.

Suggest a Spin
/ How a Spin works

Scoped like software.
Delivered like a product.

001

Scope

One call. We map your jurisdiction, data boundary, and regulatory surface, then hand you a fixed-scope, fixed-price blueprint.

002

Spin up

The service stands up inside your environment - your cloud, your rack, your keys. Nothing leaves the boundary you drew.

003

Hand over

You get the running system, the evidence trail, and the runbook. No lock-in, no retainer required to keep the lights on.

/ The registry

Every Spin is a command,
not a sales cycle.

Each engagement is scoped like software: a named service, a fixed deliverable, a predictable timeline. You always know what is running and what it costs.

gospinup — registryv0.1.0
$ gospinup spin list
spin/sovereign-aiavailable
spin/compliance-auditavailable
spin/pqc-auditcoming soon
spin/agentic-platformcoming soon
spin/data-residencycoming soon
spin/slopguardcoming soon
spin/deadline-trackercoming soon
$ gospinup spin up sovereign-ai --jurisdiction ca
/ Why GoSpinUp

Small on purpose.

GoSpinUp is a founder-led practice, not a platform pretending to be one. That means direct access to the person doing the work, scope that doesn't drift, and honest answers about what we can and can't take on. For a first sovereign deployment or a first PQC audit, that is exactly the shape of partner a regulated team can actually buy.

1:1

Direct access to the builder, no account layer.

Fixed

Scope and price agreed before work starts.

CA

Canadian-based and operated, NDA-friendly.

Find out where you actually stand.

Twenty minutes, no pitch. If you don't need an audit, I'll tell you that — it's a faster conversation for both of us.

  • ✓One reply, from me. Not a sequence, not an SDR.
  • ✓NDA-friendly. Happy to sign before we talk specifics.
  • ✓A price on the call. Fixed scope, no discovery invoice.
  • ✓No newsletter. Your email is used to reply to you.

Usually a same-day reply. If it turns out you don't need an audit, I'll say so.