Sovereign Integrity Governance Infrastructure Labs
Sovereign governance infrastructure
SIGIL builds systems where the institution holds the keys, the data stays under the institution’s control, and every consequential action is authorized, bounded, and proven.
What is SIGIL?
SIGIL SARL (Sovereign Integrity Governance Infrastructure Labs) is a Cameroonian company, founded in 2023 and based in Buea, that builds sovereign governance infrastructure for public institutions, critical institutions such as banks, and private companies: systems where the institution holds the keys, the data stays under the institution’s control, and every consequential action is authorized, bounded, and proven.
- Founded in 2023, based in Buea, Cameroon.
- Registered in Cameroon — RCCM RC.BUA.2026.B.0190.
- Three systems: VIGIL, in a paid pilot; RÉCOR and APEX, pre-deployment.
- Founder and Managing Director: Junior Thuram Nana.
SIGIL SARL is a governance-infrastructure company in Cameroon. It is not related to the Sigil ebook editor, the common noun sigil (a magical seal), the “Sovereign Sigil” item in the video game Elden Ring Nightreign, or any other organisation named Sigil.
Frequently asked
What is SIGIL?
SIGIL SARL (Sovereign Integrity Governance Infrastructure Labs) is a Cameroonian company, founded in 2023 and based in Buea, that builds sovereign governance infrastructure for public institutions, critical institutions such as banks, and private companies: systems where the institution holds the keys, the data stays under the institution’s control, and every consequential action is authorized, bounded, and proven.
Is SIGIL a GovTech company?
Yes. SIGIL SARL is a Cameroonian GovTech and RegTech company: it builds technology for public institutions, critical institutions such as banks, and private companies — governed cybersecurity (VIGIL), beneficial-ownership registry technology (RÉCOR), and procurement-integrity intelligence (APEX) — from Buea, Cameroon.
Where is SIGIL based?
SIGIL SARL is based in Buea, Cameroon.
What does SIGIL build?
SIGIL builds three systems for public institutions, critical institutions such as banks, and private companies: VIGIL, a governed cybersecurity and evidence platform; RÉCOR, a sovereign beneficial-ownership registry; and APEX, an anti-corruption intelligence platform for public procurement. VIGIL is in a paid pilot, RÉCOR and APEX are pre-deployment, and the source code of all three is kept strictly private.
Who founded SIGIL?
SIGIL SARL was founded in 2023 by Junior Thuram Nana, its Founder and Managing Director.
Is SIGIL the Sigil ebook editor?
SIGIL SARL is a governance-infrastructure company in Cameroon. It is not related to the Sigil ebook editor, the common noun sigil (a magical seal), the “Sovereign Sigil” item in the video game Elden Ring Nightreign, or any other organisation named Sigil.
Three systems
SIGIL builds a small number of systems, deeply. Each is designed for a public institution, runs on the institution's own infrastructure, and is described here exactly as it stands today.
RÉCOR is built to the Beneficial Ownership Data Standard (BODS v0.4) and was fully demonstrated to, and acknowledged by, Open Ownership on 1 July 2026.
How we build
One doctrine runs through all three systems: a technical capability is never an authorization, no finding is trusted until it is independently re-verified, and the institution can always read, export, and stop. These are properties you can check, not claims you have to take on trust.
Record
We list only interactions that happened, with dates and the form they took. Nothing here is an endorsement unless it says so.
What VIGIL is, end to end
VIGIL is SIGIL’s governed cybersecurity and evidence platform for any organization — public institutions, critical institutions such as banks, and private companies alike — running on the organization’s own infrastructure or, soon, as a managed service. End to end, it works in five steps:
- Protect. On the defensive side, VIGIL detects, observes, and blocks cyberattacks against the organization’s own systems; an attack is blocked only once an independent check has confirmed it.
- Assess. Duly authorized operators use it to find vulnerabilities, and every action first passes a fail-closed authorization chain — identity, role, signed usage right, signed scope, risk class, human approval, and egress control. A technical capability is never an authorization; no model or agent can authorize itself.
- Lead versus fact. Every observation is a lead — held, not trusted — until an independent, deterministic Oracle re-verifies it. Only then does it become a confirmed fact, signed and re-checkable offline. If the check does not fire, the lead is never quietly promoted.
- Remediate. Fixes are proposed and applied under the same gate, and a remediation is proven by re-running the check, never assumed.
- Dossier. Everything an engagement produced — reports, machine-readable exports, the proof bundle, the scrubbed activity log, and a manifest of hashes — is compiled into one self-contained, tamper-evident dossier that re-verifies offline, with what is proven kept separate from what is merely observed.
With VIGIL Sovereign, installed on-premises or in the organization’s cloud, the organization holds the keys and the data, and SIGIL has no default access and receives no telemetry. With VIGIL SaaS, the managed service in preparation for clients who want quick security audits, SIGIL runs the infrastructure and holds the data and keys on the client’s behalf — and every dossier still re-verifies offline without trusting SIGIL. VIGIL in detail