Sovereign infrastructure, designed to support Indigenous data governance.
NORHI is a CCAB-certified Indigenous-owned business. Our infrastructure is designed to support OCAP® principles, with deployment architecture that gives Indigenous communities meaningful control over data ownership, access, and possession.
CCAB-certified
Certified Indigenous-owned business under the Canadian Council for Aboriginal Business’ Certified Aboriginal Business program.
IBD-registered
Registered on the federal Indigenous Business Directory; recognized as 51% Indigenous-owned and -controlled.
OCAP®-aligned architecture
Infrastructure designed to support OCAP® principles — ownership, control, access, and possession.
Designed to support OCAP® principles.
NORHI does not claim OCAP® certification — no such certification exists. Compliance with OCAP® is determined by the community, not by a vendor. What we provide is infrastructure designed to support the principles, configurable to each community’s interpretation of them.
Ownership
The principle
First Nations communities collectively own their information. Ownership is asserted through the relationship between the community and its data, including cultural knowledge.
How NORHI supports it
Boreal Enterprise and Boreal Airgap deployments place infrastructure on customer-owned hardware under customer-governed network policy. There is no NORHI-controlled cloud layer between the community and its data. Per-deployment governance agreements are co-authored, not pre-written by NORHI.
In practice
When a community deploys NORHI infrastructure, the community retains assertion of ownership over the data it generates. NORHI provides the means; the community governs.
Control
The principle
First Nations have authority over the collection, use, and management of their information — from the moment of design through the entire research or service lifecycle.
How NORHI supports it
Configuration is per-deployment. Data classes (audio, structured notes, audit logs) have configurable retention, access, and replication policies. Audit telemetry can be externalized to community-controlled logging or fully airgapped, depending on the community’s requirements.
In practice
The community decides what flows where, on what schedule, retained how long. NORHI’s default configuration is a starting point for that conversation, not the answer.
Access
The principle
First Nations decide who has access to their information and under what conditions. Access is governed by the community, not by external decision-makers.
How NORHI supports it
Identity and access management is configurable per deployment. Role-based access policies, multi-factor authentication, and audit-trail visibility are standard. Cross-community data sharing is opt-in, not default. NORHI staff do not access community data in the course of normal operations.
In practice
The community controls the access list. Operational support from NORHI uses break-glass procedures with community approval, not standing access.
Possession
The principle
Possession is the mechanism by which Ownership is asserted. Physical control over information — where it lives, how it is stored, who handles the media — matters as much as the legal claim of ownership.
How NORHI supports it
Boreal Edge deployments include an optional Continuity configuration that keeps data on-site only, with no replication to NORHI infrastructure. Boreal Airgap deployments have no external connectivity at all. Hardware can be customer-owned where the community requires it. Encrypted storage uses hardware-backed keys that are never exfiltrated.
In practice
For communities that interpret Possession as “data physically resides on community-owned hardware,” we can deploy that. For communities that interpret it as “data resides on Canadian sovereign infrastructure under our governance,” we can deploy that. We don’t advocate for one interpretation over the other; that’s the community’s decision.
OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC), registered with the Canadian Intellectual Property Office in August 2015.
Inuit and Métis governance frameworks
OCAP® principles were developed by First Nations communities for First Nations contexts. Inuit and Métis communities have their own data governance frameworks that NORHI respects and supports:
- Inuit: The National Inuit Strategy on Research (NISR) and Inuit Qaujimajatuqangit, governance led by Inuit Tapiriit Kanatami (ITK) and the regional Inuit organizations.
- Métis: Métis-specific data governance principles led by the Métis National Council and the Governing Members of the Métis Nation.
NORHI’s deployment architecture — per-deployment governance agreements, configurable data flows, customer-owned hardware options — supports communities operating under any of these frameworks.
Indigenous-owned. Recognized. Procurement-ready.
CCAB Certified Aboriginal Business
NORHI is certified by the Canadian Council for Aboriginal Business (CCAB) under the Certified Aboriginal Business program. Certification requires documented Indigenous ownership and control plus substantive review — it is not a self-attestation.
CCAB certification is recognized across Canadian public-sector and private-sector procurement processes as verification of Indigenous business status.
Indigenous Business Directory
NORHI is registered on the federal Indigenous Business Directory (IBD), administered by Indigenous Services Canada. The IBD is the federal government’s official registry of businesses verified as 51% Indigenous-owned and -controlled.
Registration on the IBD is the standard prerequisite for most federal procurement opportunities directed to Indigenous businesses.
Founder Victor Vien is Métis with Northern Ontario heritage. NORHI’s status as a Métis-owned business is the basis of its CCAB certification and IBD registration.
Working with an Indigenous health organization?
If you’re evaluating sovereign infrastructure for an Indigenous health authority, regional health organization, or community-based primary care service, we’d be glad to discuss what a deployment could look like. Each engagement begins with a conversation about your community’s data governance interpretation; we don’t bring a pre-written contract.