TECHNICAL BLUEPRINT • DEFENSE ARCHITECTURE

The 3-2-1-1-0 Framework & Four Defense Pillars

Canada IT Pro delivers business continuity using an enterprise-grade 3-2-1-1-0 architecture that eliminates single points of failure across storage media, physical locations, and verification routines.

Explore Four Pillars of Defense ↓
Enterprise Blueprint

Zero Single Points of Failure

Built to survive ransomware encryption, hardware failures, physical office disasters, and human error without data loss.

3

Copies of Business Data

Your live production data, a local on-premise backup appliance repository, and an air-gapped sovereign Canadian cloud repository.

  • Live Production Environment
  • Local Gigabit NAS Appliance
  • Offsite Canadian Cloud Vault
2

Different Storage Media

High-performance local enterprise network-attached storage paired with cloud-native S3 object storage for resilient cross-media survivability.

  • Enterprise Hardware NAS
  • Cloud-Native S3 Object Storage
  • Eliminates single media corruption
1

Copy Stored Offsite

Replicated outside the local disaster radius to an enterprise Tier-III Canadian facility (ca-central-1).

  • Canadian Datacenter (ca-central-1)
  • Survives fires, floods & theft
  • 100% Canadian Data Sovereignty
1

Copy Immutable (Air-Gapped)

Protected by mathematically unalterable WORM policies at the local Btrfs filesystem layer and offsite S3 Compliance Mode Object Lock.

  • Local Btrfs WORM Snapshots
  • S3 Compliance Mode Object Lock
  • Immune to Ransomware & Rogue Admins
0

Restore Errors Confirmed

Confirmed through automated daily block-level SHA-256 checksum scans and scheduled verified file restore testing to staging environments.

  • Daily SHA-256 Checksum Scans
  • Scheduled Verified Restore Tests
  • Automated CRA Audit Logs

Automated Continuous Pipeline Flow

Step 1

Local WORM Lock

Written to local appliance with AES-256 volume encryption and hardened Linux Btrfs immutable snapshots.

→
Step 2

Encrypted Transit

Replicated over TLS 1.3 tunnels with Perfect Forward Secrecy to the Canadian cloud repository.

→
Step 3

S3 Compliance Lock

Locked under 30-day rolling Wasabi S3 Compliance Mode. Deletion requests are rejected at storage layer.

→
Step 4

Hash Verification

Automated SHA-256 checksum scans and scheduled file restore tests extract and validate sample files.

Core Defenses

The Four Pillars of Sovereign Defense

Every layer of Canada IT Pro's architecture is engineered around cryptographic isolation, immutable storage primitives, and strict Canadian jurisdiction.

Pillar 1

Cryptographic Isolation & Zero Plain-Text Privacy

Data protection begins with confidentiality. Canada IT Pro enforces an end-to-end cryptographic pipeline that ensures zero plain-text data exposure during transit or at rest:

  • Volume-Level Storage Encryption: The on-premise appliance utilizes AES-256-XTS volume encryption. If hardware or physical drives are stolen from your office, the raw data cannot be read without the cryptographic key.
  • Client-Side Envelope Encryption: Prior to offsite transmission, data is compressed and encrypted on-premise using a private AES-256 encryption key. Data is fully encrypted before it touches external networks.
  • Transport Layer Security: Offsite replication streams are encapsulated within TLS 1.3 tunnels using Perfect Forward Secrecy (PFS) and SHA-256 hashing to prevent inspection or tampering.
  • Zero Plain-Text Access: Canada IT Pro monitors infrastructure telemetry, storage capacity, and backup success metrics using role-based access controls. Our monitoring tools do not allow technicians to inspect, view, or export the contents of your confidential client records, tax working papers, or legal correspondence.
Pillar 2

Local Hardware Appliance & Btrfs Filesystem Immutability

Traditional network backups fail because standard Windows file shares (SMB/CIFS) can be accessed and encrypted by ransomware using compromised administrative credentials. Canada IT Pro isolates this attack surface:

  • Dedicated On-Premise Appliance: We deploy and maintain an enterprise hardware appliance on your local network. The appliance operates on a hardened, out-of-band Linux storage kernel that remains completely separated from your corporate Windows domain.
  • Btrfs Filesystem WORM Snapshots: Backup repositories are captured via scheduled, read-only Btrfs snapshots locked under Write-Once-Read-Many (WORM) rules.
  • Malware Immunity: Even if an attacker compromises Domain Administrator credentials on your office network and attempts to wipe network shares, the underlying storage OS rejects modification and deletion commands targeting locked snapshots.
  • Rapid Local Recovery: Because backup data resides on your high-speed local network, multi-terabyte system restorations complete in minutes, avoiding the prolonged downtime associated with downloading massive datasets over commercial internet connections.
Pillar 3

Air-Gapped Cloud Protection via S3 Compliance Mode

A local appliance protects against hardware failures and local malware incidents, but a complete continuity strategy must survive physical site disasters such as fires, water damage, or theft:

  • Canadian Cloud Repository: Encrypted backup streams replicate daily to our enterprise cloud object storage vault located in Canada (ca-central-1).
  • S3 Compliance Mode Object Lock: Offsite data is committed using Wasabi S3 Object Lock configured in strict Compliance Mode. Unlike basic governance modes that permit administrative overrides, Compliance Mode cannot be bypassed, shortened, or overridden by external cybercriminals, client employees, or Canada IT Pro engineers.
  • Rolling Tamper-Proof Windows: Cloud data is committed under a rolling 30-day retention lock. Any API deletion command sent to the bucket is rejected at the storage layer until the retention timer has expired.
  • Engineered Version Rotation: Hyper Backup retention is set to 31 daily versions. This ensures automated version rotation occurs smoothly after the 30-day object lock window passes, preventing locked-storage rotation failures.
Pillar 4

100% Canadian Data Sovereignty

Data residency is a critical legal and professional requirement for Ontario accounting and law firms:

  • Strict National Residency: All offsite backup repositories remain strictly inside Canadian borders within an enterprise Tier-III datacentre (ca-central-1). No data enters or passes through the United States.
  • Protection from Foreign Extra-Territorial Laws: Storing Canadian legal, financial, and client files in US-based cloud datacentres exposes your business to the US CLOUD Act, allowing foreign authorities to compel service providers to disclose data without Canadian court oversight. Canada IT Pro keeps your data governed solely under Canadian federal and Ontario provincial law.
  • Enterprise Infrastructure Durability: Offsite storage environments feature 99.999999999% (11 9s) data durability, redundant N+1 power systems, environmental suppression, and 24/7 biometric physical security.
Mathematical Integrity

Verified File Restore Testing & Integrity Assurance

Canada IT Pro implements automated verification routines and active file restore validation to guarantee recovery readiness down to the SHA-256 hash level.

Automated Block Checksums

Every backup job runs automated SHA-256 block-level checksum scans. If physical storage media experiences silent bit rot or degradation, the filesystem detects it and automatically repairs damaged blocks from parity data.

Verified File Restore Testing

The system executes scheduled, automated file restore tests. Critical files, database components, and sample application archives are actively restored to an isolated staging directory on the appliance.

Hash & Structural Comparison

Restored test files are compared against production source checksums to confirm that files decompress cleanly, maintain structural integrity, and are readable by accounting and legal applications without corruption.

Audit Logs (CRA IC05-1R1)

Restore testing logs generate an auditable record of successful recovery validations, satisfying paragraph 17 of CRA Information Circular IC05-1R1 regarding electronic record readability and retrieval testing.

ARCHITECTURAL CONSULTATION

Ready to Implement the Sovereign Continuity Standard?

Get an on-site hardware staging plan tailored for your Ottawa office. Dedicated on-premise hardware appliance included, deployed and managed by our engineers.

Next: Review Ontario Compliance →