Companies retire hardware that is still excellent. Sovereign Circuit takes it in, sanitizes it to a published standard, proves the wipe, matches it to a real workload, and places it running the full sovereign stack — on a subscription, not a purchase.
The reference model is a proven one: the vendor owns the machine, places it on site, keeps it supplied, and when it fails it is swapped same-or-better immediately rather than repaired in place while the customer waits. Coffee machines, printers and copiers ran this way inside hospitals for decades. The customer's outcome was never "I own this." It was "a working machine is always here."
They owned all the equipment. They put it in the hospitals, they brought the toner and the paper, and if it ever broke down it got swapped out immediately with the same or better.
That is the whole business, translated one column at a time. What changes is what the consumable is: not toner and paper, but policy, protection, evidence, and updates.
IT hardware subscription and Device-as-a-Service is sized around USD 17.67 billion in 2026, heading to USD 48.15 billion by 2031 (Mordor Intelligence).
IT Asset Disposition was valued around USD 21.98 billion in 2025 (SNS Insider), with the enterprise segment at USD 7.74 billion (Fortune Business Insights).
Refurbishers cannot add sovereign infrastructure. Software companies cannot ship certified sanitized hardware. Neither runs dual-attested valuation. Doing all three, with evidence, is the position.
Nothing enters or leaves the loop undocumented. That is what lets the program publish real diversion figures instead of marketing claims — and what lets a customer's auditor trace any unit end to end.
Businesses hand over retiring fleets and get back something more useful than a disposal invoice.
The part that has to be genuinely rigorous, because the whole brand rests on evidence rather than assertion.
Tiers mirror the existing Sentinel structure so pricing stays coherent across the portfolio. Published prices are a floor and are not undercut.
Failed, aged-out and upgraded units come back in. The loop is what makes the economics work and the environmental claim true.
Every secondary-hardware market runs on information asymmetry: whoever knows more about the machine wins. This deletes the advantage in both directions. The program cannot lowball a seller, and a seller cannot conceal a fault, because both numbers were locked before either was visible.
The holder submits their own claim. Intake performs its own inspection. Neither sees the other's work.
Each valuation is hashed with a nonce and the hash published first. Nobody can revise a number after seeing the other side's.
Both open simultaneously. Hashes are checked against the revealed values, so a changed number is detectable.
Within the published band, the transaction settles at the midpoint. No negotiation, no haggling, no sales pressure.
A published market-comparable index plus documented review. The reason for the gap is recorded — disputes become data.
Both valuations, both identities, the settlement math and the evidence go into a hash-chained record either party can produce years later.
When a customer trades up at refresh, the residual credit on the returned unit is set the same way. They are not accepting whatever the vendor says their old machine is worth.
That is precisely where phone carriers lose customer trust. Doing it with sealed dual attestation turns the single most resented moment in the subscription-hardware model into the most defensible one. It is also the doctrine applied to money: the holder's claim is an assertion, the inspection is an observation, and the record shows both rather than collapsing them into one price.
The full normative spec: canonical serialisation, commitment construction, the six-stage round, settlement arithmetic, the security analysis including the weakness we have not yet solved, eight normative test vectors, and a reference implementation that reproduces every one of them. The page carries a working commit-reveal demo you can run in this browser.
A machine that is no longer a fit for a business is not a worse machine. It is a machine whose best use has changed. Every move down the ladder carries a documented reason, and the reason is a fit change — not a defect.
A concrete example of a fit change that is not a defect: Microsoft requires TPM 2.0 for Windows 11 and has held that line as an indispensable standard rather than relaxing it (PCWorld), and TPM 1.2 is explicitly no longer sufficient (CRN). A perfectly good machine can fail a business baseline for a reason that has nothing to do with whether it works well for a ten-year-old learning to type.
Hardware is matched to the workload. Protection is not. A child's machine ships with the same Sentinel protections, the same egress policy, the same evidence vault and the same gateway boundary as a business fleet unit.
Normally the cheapest customer gets the weakest protection. Here the cheapest customer gets a machine that is older and protection that is not. If anything a child's device carries more policy, not less — safety and content controls, the anchored-zone logic from Safe Perimeter, and the tightest egress rules in the program.
The security envelope is not installed at the end — it wraps the hardware at every stage of its life. This is defensible only because the program controls the entire path rather than selling a box and hoping.
A failure means a same-or-better unit is on site inside a committed window, already imaged and policy-loaded, with the failed unit sealed and returned. The customer never diagnoses, never waits on parts, never loses their configuration.
The failure is also an evidence event. If a unit failed because of tampering rather than wear, that distinction is visible in the record — and it is a Sentinel incident, not a warranty claim.
Every subscription includes a defined refresh at 24 or 36 months depending on tier, moving the customer to a newer graded unit with no additional capital cost. The residual on the returned unit is set by dual attestation.
This is the mechanic that turns a one-time refurb sale into recurring revenue — and it guarantees intake a predictable return volume, which is what makes the supply side work at all.
A paid layer separate from the swap promise: setup, migration, hardening review, family onboarding, policy tuning and incident support. Priced per seat or per household, with a higher tier for businesses that want a named engineer.
A business subscriber can extend seats to employees' households at a member rate. That is how the fleet reaches homes beyond the office, and it is a real benefit an employer can advertise.
Service contracts are typically distinct from insurance — offered by a third party for separately stated consideration, covering breakdown from normal wear — and most states impose financial adequacy and licensing requirements on the obligor (NCOIL). The distinction between warranty, service contract and insurance turns on who owes the obligation and what triggers it (IRMI). States codify these separately — Virginia defines an extended service contract as a written agreement for a set duration in return for a segregated charge (Virginia Law), and California separates dealer-obligor contracts from mechanical breakdown insurance with different regulatory treatment (ConsumerAffairs).
Practical read: because Sovereign Circuit owns the equipment and the customer subscribes rather than buys, replacement-on-failure is cleanest as a service-level obligation inside the subscription — not an insurance product and not a separately sold warranty. That is the simpler regulatory path. A separately priced add-on for accidental damage, loss, theft or cyber-incident recovery is the point to bring in counsel and likely an underwriting partner.
IoT is where the soft underbelly is. Cameras, badge readers, HVAC controllers, printers, medical peripherals, thermostats and sensors rarely get patched, often cannot run an agent, and sit on the same flat network as everything that matters. The program's structural advantage is that it is already placing a gateway on site.
IoT is a protected tier, not a set of endpoints. The devices are treated as unpatchable and compromised-capable. Protection happens at the boundary around them, never on them.
Every IoT segment sits behind the on-prem gateway. Nothing reaches the internet or the business network except by explicit policy — the same ALLOW / INSPECT / BLOCK model, pointed inward at the device population.
Where a segment must be genuinely isolated — life-safety, control systems, ballot or evidence hardware — the crossing is a controlled one-way path with import and export gates, not a firewall rule.
Enroll every device, record what normal traffic looks like, alert on deviation. For devices that cannot be patched, knowing exactly what they should ever be doing is the only real control.
Every boundary decision is loggable and exportable into the evidence vault, so an IoT incident produces an investigator-ready package rather than a vague alert history.
Refurbished units plus a real IoT segment behind a real gateway is a curriculum. A student can watch a badge reader try to phone home, then watch policy stop it. This is the Cyber Labs and Digital Resilience Lab angle made concrete.
Because the program owns both the supply side and the placement side, discounts can be denominated in program value — far cheaper than cash, and every credit pulls the loop tighter. Stacking rules and caps still need setting so discounts cannot erode the price floor.
| Credit | Earned by | Why it pays for itself |
|---|---|---|
| Supply credit | Handing over a retiring fleet | Turns a disposal cost into subscription value and secures inventory |
| Verified-condition bonus | Self-assessments landing inside tolerance | Buys honest grading; cuts inspection and dispute cost |
| Cascade credit | Letting a unit continue down the tiers | Feeds family and education tiers at almost no acquisition cost |
| Sponsorship credit | Funding a named school lab, church or cohort | Buys a real, publishable story for the sponsor |
| Household extension | A business extending seats to employees' homes | Distribution into households at near-zero acquisition cost |
| Return-on-time credit | Returning swapped or refreshed units promptly | Keeps reverse logistics predictable and cheap |
| Multi-year commitment | Longer subscription terms | Improves financing terms on the fleet |
| Referral | Bringing in another supply company or site | The cheapest acquisition channel available |
Because every unit is tracked through the cascade, the program can report actual service-life extension per device rather than an industry average — consistent with the portfolio's refusal to present assertions as evidence. The reason it matters is that the numbers are stark.
Up 82% from 2010 and on track to reach 82 million tonnes by 2030.
Global E-waste Monitor 2024Leaving USD 62 billion in recoverable resources unaccounted for, at an average of 7.8 kg per person per year.
ITUDriven by component fabrication in coal-dependent regions. For a typical laptop about 84% of the footprint sits in Scope 3, with semiconductor and board fabrication alone around 38%.
Aalto University · ClimatecostCalculated for the notebooks certified in 2019 if used six years instead of four. Extending a corporate refresh cycle by even one year measurably cuts a workplace footprint.
TCO Certified · ComputerworldThe greenest computer is the one that already exists.
Destroying a working machine wastes carbon that was already spent — most of a device's footprint was emitted before it was ever switched on. Every cascade step is carbon already paid for, being used instead of thrown away. Extending life is the single highest-leverage action available, and it happens to also be the cheapest way to put a protected system in someone's hands.
None of these are trivial, and overclaiming on any of them would undermine the whole brand. They belong on the board next to the upside.
Swap inventory must exist before the first failure. This is an asset-heavy business and likely needs equipment financing or a leasing partner rather than being funded from subscription cash flow.
Depots or a partner with existing coverage. Reverse logistics is the single most underestimated cost in this entire model.
Wiping the disk is the easy half. Establishing supply-chain provenance on used enterprise hardware is the hardest part of the intake line, and the honest position may be "verified to this documented level, not beyond."
R2v3 is cited in the USD 15K–40K range, with e-Stewards stricter and pricier (Investment Recovery Association), plus ISO 9001, 14001 and 45001 or RIOS. Budget time as well as money.
Service-contract regulation varies by state, leasing rules may apply, and accepting a client's drive means accepting custody of their data until it is destroyed.
Support has to be scoped and priced, and the self-install swap path has to actually work without a truck roll.
Used enterprise hardware has real failure curves. Windows should not be published until they are grounded in the program's own intake history.
In rough order. The first four are specification and documentation work that can be done and demonstrated before a single unit is acquired.
The software that ships on every unit; the existing tier structure this stays consistent with.
Node admission, egress policy, audit chain, and the airlock and perimeter patterns behind the IoT boundary.
The local and offline development boundary for developer-tier units.
The training and curriculum home for the Cyber Labs angle and the live IoT range.
Anchored-zone and proximity logic that shares the on-site gateway with the network boundary.
Sealed-enclave and offline-update patterns for the highest tiers.
Currently in build. This program is its hardware distribution channel.