Companies retire hardware that is still excellent. Sovereign Circuit takes it in, sanitizes it to a published standard, proves the wipe, matches it to a real workload, and places it running the full sovereign stack — on a subscription, not a purchase.
The reference model is a proven one: the vendor owns the machine, places it on site, keeps it supplied, and when it fails it is swapped same-or-better immediately rather than repaired in place while the customer waits. Coffee machines, printers and copiers ran this way inside hospitals for decades. The customer's outcome was never "I own this." It was "a working machine is always here."
They owned all the equipment. They put it in the hospitals, they brought the toner and the paper, and if it ever broke down it got swapped out immediately with the same or better.
That is the whole business, translated one column at a time. What changes is what the consumable is: not toner and paper, but policy, protection, evidence, and updates.
IT hardware subscription and Device-as-a-Service is sized around USD 17.67 billion in 2026, heading to USD 48.15 billion by 2031 (Mordor Intelligence).
IT Asset Disposition was valued around USD 21.98 billion in 2025 (SNS Insider), with the enterprise segment at USD 7.74 billion (Fortune Business Insights).
Refurbishers cannot add sovereign infrastructure. Software companies cannot ship certified sanitized hardware. Neither runs dual-attested valuation. Doing all three, with evidence, is the position.
Nothing enters or leaves the loop undocumented. That is what lets the program publish real diversion figures instead of marketing claims — and what lets a customer's auditor trace any unit end to end.
Businesses hand over retiring fleets and get back something more useful than a disposal invoice.
The part that has to be genuinely rigorous, because the whole brand rests on evidence rather than assertion.
Tiers mirror the existing Sentinel structure so pricing stays coherent across the portfolio. Published prices are a floor and are not undercut.
Failed, aged-out and upgraded units come back in. The loop is what makes the economics work and the environmental claim true.
Every secondary-hardware market runs on information asymmetry: whoever knows more about the machine wins. This deletes the advantage in both directions. The program cannot lowball a seller, and a seller cannot conceal a fault, because both numbers were locked before either was visible.
The holder submits their own claim. Intake performs its own inspection. Neither sees the other's work.
Each valuation is hashed with a nonce and the hash published first. Nobody can revise a number after seeing the other side's.
Both open simultaneously. Hashes are checked against the revealed values, so a changed number is detectable.
Within the published band, the transaction settles at the midpoint. No negotiation, no haggling, no sales pressure.
A published market-comparable index plus documented review. The reason for the gap is recorded — disputes become data.
Both valuations, both identities, the settlement math and the evidence go into a hash-chained record either party can produce years later.
When a customer trades up at refresh, the residual credit on the returned unit is set the same way. They are not accepting whatever the vendor says their old machine is worth.
That is precisely where phone carriers lose customer trust. Doing it with sealed dual attestation turns the single most resented moment in the subscription-hardware model into the most defensible one. It is also the doctrine applied to money: the holder's claim is an assertion, the inspection is an observation, and the record shows both rather than collapsing them into one price.
The full normative spec: canonical serialisation, commitment construction, the six-stage round, settlement arithmetic, the security analysis including the weakness we have not yet solved, eight normative test vectors, and a reference implementation that reproduces every one of them. The page carries a working commit-reveal demo you can run in this browser.
A machine that is no longer a fit for a business is not a worse machine. It is a machine whose best use has changed. Every move down the ladder carries a documented reason, and the reason is a fit change — not a defect.
A concrete example of a fit change that is not a defect: Microsoft requires TPM 2.0 for Windows 11 and has held that line as an indispensable standard rather than relaxing it (PCWorld), and TPM 1.2 is explicitly no longer sufficient (CRN). A perfectly good machine can fail a business baseline for a reason that has nothing to do with whether it works well for a ten-year-old learning to type.
Hardware is matched to the workload. Protection is not. A child's machine ships with the same Sentinel protections, the same egress policy, the same evidence vault and the same gateway boundary as a business fleet unit.
Normally the cheapest customer gets the weakest protection. Here the cheapest customer gets a machine that is older and protection that is not. If anything a child's device carries more policy, not less — safety and content controls, the anchored-zone logic from Safe Perimeter, and the tightest egress rules in the program.
The security envelope is not installed at the end — it wraps the hardware at every stage of its life. This is defensible only because the program controls the entire path rather than selling a box and hoping.
A failure means a same-or-better unit is on site inside a committed window, already imaged and policy-loaded, with the failed unit sealed and returned. The customer never diagnoses, never waits on parts, never loses their configuration.
The failure is also an evidence event. If a unit failed because of tampering rather than wear, that distinction is visible in the record — and it is a Sentinel incident, not a warranty claim.
Every subscription includes a defined refresh at 24 or 36 months depending on tier, moving the customer to a newer graded unit with no additional capital cost. The residual on the returned unit is set by dual attestation.
This is the mechanic that turns a one-time refurb sale into recurring revenue — and it guarantees intake a predictable return volume, which is what makes the supply side work at all.
A paid layer separate from the swap promise: setup, migration, hardening review, family onboarding, policy tuning and incident support. Priced per seat or per household, with a higher tier for businesses that want a named engineer.
A business subscriber can extend seats to employees' households at a member rate. That is how the fleet reaches homes beyond the office, and it is a real benefit an employer can advertise.
Service contracts are typically distinct from insurance — offered by a third party for separately stated consideration, covering breakdown from normal wear — and most states impose financial adequacy and licensing requirements on the obligor (NCOIL). The distinction between warranty, service contract and insurance turns on who owes the obligation and what triggers it (IRMI). States codify these separately — Virginia defines an extended service contract as a written agreement for a set duration in return for a segregated charge (Virginia Law), and California separates dealer-obligor contracts from mechanical breakdown insurance with different regulatory treatment (ConsumerAffairs).
Practical read: because Sovereign Circuit owns the equipment and the customer subscribes rather than buys, replacement-on-failure is cleanest as a service-level obligation inside the subscription — not an insurance product and not a separately sold warranty. That is the simpler regulatory path. A separately priced add-on for accidental damage, loss, theft or cyber-incident recovery is the point to bring in counsel and likely an underwriting partner.
IoT is where the soft underbelly is. Cameras, badge readers, HVAC controllers, printers, medical peripherals, thermostats and sensors rarely get patched, often cannot run an agent, and sit on the same flat network as everything that matters. The program's structural advantage is that it is already placing a gateway on site.
IoT is a protected tier, not a set of endpoints. The devices are treated as unpatchable and compromised-capable. Protection happens at the boundary around them, never on them.
Every IoT segment sits behind the on-prem gateway. Nothing reaches the internet or the business network except by explicit policy — the same ALLOW / INSPECT / BLOCK model, pointed inward at the device population.
Where a segment must be genuinely isolated — life-safety, control systems, ballot or evidence hardware — the crossing is a controlled one-way path with import and export gates, not a firewall rule.
Enroll every device, record what normal traffic looks like, alert on deviation. For devices that cannot be patched, knowing exactly what they should ever be doing is the only real control.
Every boundary decision is loggable and exportable into the evidence vault, so an IoT incident produces an investigator-ready package rather than a vague alert history.
Refurbished units plus a real IoT segment behind a real gateway is a curriculum. A student can watch a badge reader try to phone home, then watch policy stop it. This is the Cyber Labs and Digital Resilience Lab angle made concrete.
Because the program owns both the supply side and the placement side, discounts can be denominated in program value — far cheaper than cash, and every credit pulls the loop tighter. Stacking rules and caps still need setting so discounts cannot erode the price floor.
| Credit | Earned by | Why it pays for itself |
|---|---|---|
| Supply credit | Handing over a retiring fleet | Turns a disposal cost into subscription value and secures inventory |
| Verified-condition bonus | Self-assessments landing inside tolerance | Buys honest grading; cuts inspection and dispute cost |
| Cascade credit | Letting a unit continue down the tiers | Feeds family and education tiers at almost no acquisition cost |
| Sponsorship credit | Funding a named school lab, church or cohort | Buys a real, publishable story for the sponsor |
| Household extension | A business extending seats to employees' homes | Distribution into households at near-zero acquisition cost |
| Return-on-time credit | Returning swapped or refreshed units promptly | Keeps reverse logistics predictable and cheap |
| Multi-year commitment | Longer subscription terms | Improves financing terms on the fleet |
| Referral | Bringing in another supply company or site | The cheapest acquisition channel available |
Because every unit is tracked through the cascade, the program can report actual service-life extension per device rather than an industry average — consistent with the portfolio's refusal to present assertions as evidence. The reason it matters is that the numbers are stark.
Up 82% from 2010 and on track to reach 82 million tonnes by 2030.
Global E-waste Monitor 2024Leaving USD 62 billion in recoverable resources unaccounted for, at an average of 7.8 kg per person per year.
ITUDriven by component fabrication in coal-dependent regions. For a typical laptop about 84% of the footprint sits in Scope 3, with semiconductor and board fabrication alone around 38%.
Aalto University · ClimatecostCalculated for the notebooks certified in 2019 if used six years instead of four. Extending a corporate refresh cycle by even one year measurably cuts a workplace footprint.
TCO Certified · ComputerworldThe greenest computer is the one that already exists.
Destroying a working machine wastes carbon that was already spent — most of a device's footprint was emitted before it was ever switched on. Every cascade step is carbon already paid for, being used instead of thrown away. Extending life is the single highest-leverage action available, and it happens to also be the cheapest way to put a protected system in someone's hands.
None of these are trivial, and overclaiming on any of them would undermine the whole brand. They belong on the board next to the upside.
Swap inventory must exist before the first failure. This is an asset-heavy business and likely needs equipment financing or a leasing partner rather than being funded from subscription cash flow.
Depots or a partner with existing coverage. Reverse logistics is the single most underestimated cost in this entire model.
Wiping the disk is the easy half. Establishing supply-chain provenance on used enterprise hardware is the hardest part of the intake line, and the honest position may be "verified to this documented level, not beyond."
R2v3 is cited in the USD 15K–40K range, with e-Stewards stricter and pricier (Investment Recovery Association), plus ISO 9001, 14001 and 45001 or RIOS. Budget time as well as money.
Service-contract regulation varies by state, leasing rules may apply, and accepting a client's drive means accepting custody of their data until it is destroyed.
Support has to be scoped and priced, and the self-install swap path has to actually work without a truck roll.
Used enterprise hardware has real failure curves. Windows should not be published until they are grounded in the program's own intake history.
The rubric is internally consistent and externally uncalibrated. Every band edge was chosen to be defensible, not because anyone measured it against real stock. This section names each load-bearing number, says where it came from, and says exactly what evidence would move it — because a threshold with no stated provenance is indistinguishable from a threshold someone invented to win an argument.
The obvious way to calibrate is to have two experienced people grade twenty machines and check whether they agree. That method is worthless, because the second person sees the first person's numbers and agrees with them — what gets measured is deference, not reliability, and it looks like excellent agreement. So the worksheet enforces the same discipline the protocol enforces on price: both readings are recorded before either is seen. If the two graders talk during a unit, that unit is discarded rather than kept.
Two scratches of 10mm or longer is the line between Used Excellent and everything below it. Two is a plausible number. Nobody has counted scratches on a real intake batch to find out whether it falls in a gap in the distribution or straight through the densest part of it.
Moves when: the observed distribution of this count across 40+ real units shows where the natural gap is. If most stock lands at 2–4, this threshold is in the worst possible place and every unit becomes an argument.
Five small dents separates Used Good from Used Fair. The count is also the field most likely to be measured differently by two people — a 2mm dent under overhead light is not a 2mm dent under a raking light.
Moves when: Batch 1 shows how far apart two blind graders land on this one field. If they disagree often, the fix is a specified measurement method (tool, lighting, vantage point), not a wider threshold.
One millimetre of lid deflection at ninety degrees is the boundary between a sound chassis and a structural defect. This is the single most consequential guess in the rubric, because it gates several bands at once and because it is the one threshold with a time dimension — the question is not how much play there is now, it is whether 1mm becomes 4mm in eighteen months.
Moves when: roughly a hundred units are tracked longitudinally. Twenty units cannot answer this and Batch 1 will not be allowed to pretend otherwise — the instruction in the method is to record the data and leave the number alone.
Ninety percent of design capacity is the floor for Like New. It is a widely used industry convention rather than a measurement, and it is applied here to a register read off the machine, which at least makes it reproducible.
Moves when: real intake shows the distribution of reported capacity in three-to-five-year-old business stock. If almost nothing clears 90%, the band is decorative; if almost everything does, it is not doing any work.
Any non-zero reallocated or pending sector count disqualifies the drive. This follows the conservative reading of Backblaze's published SMART statistics, where those attributes correlate strongly with failure across a very large population — but that is a finding about drive models this program does not necessarily stock.
Moves when: around a hundred units plus elapsed time produce this program's own failure curve. Until then the conservative threshold stays, because being wrong in the direction of not placing a marginal drive with a family is the acceptable direction to be wrong in.
Not a guess. The categories are taken directly from NIST SP 800-88r2, and the rubric additionally requires a certificate identifier, so the claim is checkable rather than asserted. This is one of the few numbers on this page that does not need calibrating — it needs executing, on a real drive, with a real certificate.
Moves when: it does not. What changes is the evidence: the first sanitization certificate bound into a real custody log.
Anchored, but to somebody else's decision. The requirement comes from Microsoft's Windows 11 policy (CRN), which means it is a software boundary that moves when a vendor says so, not a property of the hardware. It is graded as its own field precisely so that the machines it retires can be identified as healthy rather than failed.
Moves when: the vendor moves it. The rubric version bumps and the old hash stays readable, so a grade issued today remains interpretable under the rules it was issued under.
Ten percent is the spread inside which two sealed prices settle at the midpoint automatically. Too tight and every round escalates; too wide and the band stops disciplining anyone. Ten percent is a starting value with no observed distribution behind it.
Moves when: real rounds produce a distribution of spreads. The target is a band that auto-settles the large majority of honest rounds while still catching genuine disagreement — and that ratio is measurable as soon as there are rounds to measure.
A $25 absolute floor stops a percentage band from being absurd on a cheap unit, and a 250 bp bonus rewards both sides independently verifying condition. Both numbers are arbitrary in magnitude while being deliberate in direction.
Moves when: the first batch of low-value units shows whether the floor is doing anything, and whether the bonus is large enough to change behaviour or just large enough to complicate the arithmetic.
The most honest item on this page. When two sealed prices fall outside the band, the settlement escalates to a published comparable index — and that index does not exist. The name is a placeholder in the policy so that the escalation path is structurally present and cannot be quietly replaced by negotiation later.
Moves when: there is enough settled volume to publish a comparable index, or a third-party index is adopted and named. Until then, an escalated round has no automatic resolution and the code says so rather than inventing one.
The rubric_hash covers the field registry and the band logic, and every grade token binds it. So a threshold change makes every grade issued under the old rules non-comparable to grades issued under the new ones — deliberately, so that a grade cannot be silently reinterpreted later. Three consequences follow: never recalibrate mid-batch, bump the rubric version on any threshold change, and keep the old version readable so a unit graded in Batch 1 and re-graded in Batch 4 shows both grades and both hashes rather than a rewritten history.
The worksheet and the analyser are built and generated from the live field registry, so the sheet cannot drift from the code that grades it. What is missing is twenty machines and two people willing to grade them without talking to each other. See the full field registry →
In rough order. Items 01 through 04 are written, tested and published. Everything up to 4b was specification work needing no hardware — 4b is the first step that does, because a threshold cannot be calibrated against machines nobody has touched.
The software that ships on every unit; the existing tier structure this stays consistent with.
Node admission, egress policy, audit chain, and the airlock and perimeter patterns behind the IoT boundary.
The local and offline development boundary for developer-tier units.
The training and curriculum home for the Cyber Labs angle and the live IoT range.
Anchored-zone and proximity logic that shares the on-site gateway with the network boundary.
Sealed-enclave and offline-update patterns for the highest tiers.
Currently in build. This program is its hardware distribution channel.