Atlas Q · 11/11 IPFS · Architecture

System architecture for critical workloads

This page summarizes how Atlas Q / 11/11 IPFS is assembled: client-side encryption, post-quantum key management, decentralized identity, jurisdiction-aware IPFS residency, and immutable audit anchors. It is not a marketing diagram; it is a practical, deployable view of how the system is wired.

Client-Side AES-GCM

Kyber & Dilithium

DID Access Control

Residency Pinsets

Audit Anchors

End-to-end data flow

The 11/11 IPFS pipeline is designed so that plaintext never leaves the trust boundary of the client. The network is responsible for durability and policy enforcement, not for seeing or decrypting sensitive content.

1 · Encrypt: Client generates an ephemeral AES-GCM key and encrypts objects locally.
2 · Chunk: Objects are chunked and uploaded to region-specific IPFS pinsets.
3 · Manifest: Encrypted CIDs, owner identity, and policy IDs are assembled into a manifest.
4 · QHASH: A deterministic hash over the manifest is computed for integrity.
5 · Wrap: The data key is wrapped with Kyber for each authorized DID.
6 · Anchor: A Dilithium-signed audit entry records the action and QHASH.
7 · Retrieve: Authorized clients unwrap keys, fetch chunks, and decrypt locally.

Logical flow (conceptual):

Client → Encrypt → Chunk → IPFS pinsets
       ↘ Manifest → QHASH → Audit anchor
Keys → Kyber wraps → DID identities

Residency and sovereignty model

Residency pinsets allow Atlas Q to satisfy different regional and regulatory requirements without fragmenting the protocol itself. Each pinset is a logical group of IPFS nodes operated in a given jurisdiction or trust domain.

US-only clusters for HIPAA-aligned workloads.
EU-only clusters for GDPR and local rulings.
APAC clusters for low-latency regional access.
Private clusters for hospitals, enterprises, or governments.

Policies reference pinset IDs, not specific servers. This makes the system resilient to node churn while keeping clear residency guarantees.