Sanctum SecOps

Executive Dossier — Restricted Access
Confidential · Eyes Only
This document contains confidential financial, corporate, trust, and intellectual-property information. Access is restricted to authorized principals of Sanctum SecOps LLC.
Confidential · Prepared July 2026 · Pine City, NY

The Sanctum Executive Dossier

A consolidated five-year strategic plan for a multinational, vendor-agnostic security & post-quantum cryptography enterprise — spanning corporate restructuring, an Apex dynastic trust, patent families A–M, five layers of revenue diversification, and a DoD-first go-to-market. Built on sovereign PKI, composite PQC, and CMMC 2.0 readiness.

$21MYr-5 illustrative ARR
$35M–$2B+Yr-5 trust net worth range
13Patent families (A–M)
3Passport portfolio path
5Revenue layers
01 · Strategic Thesis

From single-entity LLC to sovereign multinational enterprise

Sanctum SecOps LLC — today a New York single-entity LLC — is reorganizing into a multi-tier, multinational corporate-trust architecture engineered for asset protection, generational wealth transfer, jurisdictional diversification, and geometric recurring-revenue growth.

PILLAR 01

Sovereign PKI & PQC

Composite ML-DSA + ML-KEM certificates, Cygnus / sanctum-quanta toolkit, Mechanism II telemetry engine — aligned to FIPS 203/204/205 and IETF standards.

PILLAR 02

DoD-First Go-To-Market

DUNS / UEI / CAGE already held — the strongest pre-revenue defense credential. CMMC 2.0, SBIR/STTR non-dilutive capital, vertical fanout Army → Navy → USAF → SOCOM → IC.

PILLAR 03

Dynastic Trust Architecture

Apex irrevocable dynasty trust owns a BVI holding company owning ring-fenced operating entities — containing liability and compounding a 13-family network.

PILLAR 04

IP Monetization

Patent families A–M plus the VSP trademark, held in a dedicated IP Co and licensed at 3–8% royalties. Each OEM/IETF licensee = $500K–$5M/yr.

PILLAR 05

Global Citizenship Path

US → Dominican Republic investor residency (6-month path) → Spain/EU via the Ibero-American 2-year treaty. A three-passport portfolio unlocking EU market access.

PILLAR 06

Revenue Diversification

Five stacked layers: direct MRR, 13-family override, technology licensing, hardware margin, and third-party IP royalties — plus index, real-asset, and venture allocations.

02 · Corporate & Trust Architecture

Multi-tier, multinational, ring-fenced

An apex dynasty trust sits above a tax-neutral BVI holding company that owns four ring-fenced Delaware operating entities plus a future EU entity — with all IP held offshore and licensed back under IRC §482 transfer pricing.

TIER 1 (APEX) — SANCTUM GLOBAL TRUST  (Irrevocable Dynasty Trust)
│   Jurisdiction: South Dakota Perpetual Dynasty Trust (preferred) / Delaware Statutory Trust
│   Trustee: Professional/institutional · Trust Protector: Founding Principal · 13 family Protector seats
│
└── TIER 2 — SANCTUM INTERNATIONAL HOLDINGS LTD  (BVI Business Company)
    │   Tax-neutral · owns ALL global IP · collects dividends, royalties, licensing fees
    │
    ├── TIER 3A — SANCTUM COMPOSITES LLC (DE)   → Cygnus / sanctum-quanta / Mechanism II PQC IP
    ├── TIER 3B — SANCTUM SILICON LLC (DE)       → HSM firmware, hardware root-of-trust, supply chain
    ├── TIER 3C — SANCTUM SECOPS OPERATING CO (DE, redomiciled from NY) → MSSP delivery, SOC, contracts
    └── TIER 3D — SANCTUM EUROPE GmbH / SL       → EU MSSP, ENISA MSS cert (Year 2–3)

2.1Apex jurisdiction comparison

FeatureDelaware Statutory TrustSouth Dakota Perpetual Trust
Perpetual durationLimited (100+ yrs renewable)Unlimited — no rule against perpetuities
Asset protectionStrongStrongest in US
PrivacyModerateVery high
Self-settled (DAPT)LimitedPermitted
Annual cost~$5K–$15K~$10K–$25K
Best forReal estate / investment holdingDynastic family wealth + business holding

2.2Alternate family-trust diversification model

VICENTE FAMILY TRUST  (Irrevocable Grantor Trust — upon first royalty)
    ├── Sanctum IP Co LLC (DE)        → all patents (A–M), VSP trademark, QuantaScript DSL, IETF draft IP → licenses (3–8%)
    ├── Sanctum Capital LLC (DE)      → 3-fund index (VTI 60 / VXUS 30 / BND 10), I-Bond ladder, REITs
    ├── Sanctum Real Assets LLC (NY/DE) → primary residence + US investment property
    ├── Sanctum Ventures LLC (DE)     → SI partnerships, hardware bundling, co-investments
    └── Sanctum DR SRL (Dominican Republic — pending citizenship) → Cap Cana / Las Terrenas RE, LatAm VSP sub-licensing

2.3Global citizenship & residency path

StageVehicleTimelineOutcome
US (current)Founding jurisdictionHome base, DoD credentialing
Dominican RepublicInvestor residency ($200K) → naturalization (Law 1683)6-mo residence / 12–18 mo2nd passport
Spain / EUIbero-American 2-yr treaty (DELE waived for DR nationals)24 mo residenceEU citizenship (3rd passport)
Strategic value: EU citizenship enables Sanctum Europe SL incorporation with a resident director, ENISA MSS certification eligibility, Horizon Europe PQC grant access, Schengen free movement, and EU banking for the BVI holding company's treasury.
03 · Financial Projections

Conservative floor to aggressive ceiling

Two lenses: a five-layer illustrative revenue model, and trust net-worth projections under conservative (solo operator) versus aggressive (funded, team-hired) scenarios. All figures are illustrative and subject to legal, tax, and market review.

3.1Illustrative revenue model — five layers

LayerYear 1Year 2Year 3Year 5
OpCo direct MRR$50K/mo$100K/mo$200K/mo$500K/mo
13 sub-licensee override (15%)$58.5K/mo$175K/mo$351K/mo$877K/mo
Composites tech license$15K/mo$45K/mo$90K/mo$225K/mo
Silicon hardware margin$5K/mo$20K/mo$50K/mo$150K/mo
Total monthly revenue$128.5K$340K$691K$1.75M
Annual revenue$1.54M$4.08M$8.29M$21M

3.2Trust net worth — conservative scenario

Solo operator, organic growth, no SBIR win, no IETF RFC in Yr 1–2.

PeriodARRIP Co equity (8–15×)Liquid + RETrust net worth
Year 1 (2026–27)$150K–$400K$1.2M–$3.6M$200K–$500K$1.4M–$4M
Year 2$500K–$1.5M$4M–$15M$500K–$1M$5M–$16M
Year 3$1.5M–$4M$12M–$40M$1M–$3M$13M–$43M
Year 5$4M–$10M$32M–$100M$3M–$8M$35M–$108M

3.3Trust net worth — aggressive scenario

DoD SBIR + first direct award, BD/legal team hired, 2–3 SI partners live, IETF WG adoption, DR citizenship secured.

PeriodARRIP Co equity (8–15×)Liquid + RETrust net worth
Year 1 (2026–27)$800K–$3M$6M–$30M$500K–$2M$7M–$32M
Year 2$5M–$15M$40M–$150M$2M–$8M$42M–$158M
Year 3$15M–$50M$120M–$500M$5M–$20M$125M–$520M
Year 5$50M–$200M$400M–$2B$15M–$60M$415M–$2B+
Key inflection point: the gap between conservative and aggressive at Year 3 is roughly 10×. The single variable driving it most is hiring business and legal professionals to run operations — freeing the Founding Principal to stay exclusively in the technical and strategic role. Valuation methodology: IP Co = ARR × 8–15× (cyber-SaaS comparables); DoD IDIQ/GWAC premium adds +20–40%; each IETF RFC OEM licensee (Thales, DigiCert, AWS) = $500K–$5M/yr. SBIR Phase I = $150K–$300K non-dilutive; Phase II = $1M–$2M.

3.4Tax optimization at a glance

Income typeCurrent (NY LLC)Optimized structure
IP licensing (Composites)~48%BVI HoldCo: 0% corporate; distributed to trust
MSSP service revenue (OpCo)~48%DE OpCo: ~21% federal; NY minimized via transfer pricing
Capital gains on entity sale23.8% + NYBVI: 0% capital gains
Hardware / Silicon margin~48%DE LLC ~21%; held by BVI HoldCo

Transfer pricing under IRC §482 and OECD guidelines is mandatory; a contemporaneous IP valuation study and qualified international tax counsel are prerequisites.

04 · Intellectual Property

Patent families A–M + VSP trademark

Thirteen patent families anchored by USPTO Application 19/698,870, plus the coined "VSP — Verified Self-Propulsion" mark. All IP is assigned to the BVI HoldCo / IP Co and licensed to operating entities.

FAMILY A

Drift-Gated Issuance

Certificate issuance gated on measured cryptographic drift signals.

FAMILY B

Consistency Gate

Cross-store consistency enforcement across PKI/PKE state.

FAMILY C

Topology-Aware Rotation

Key/cert rotation informed by CA topology graph.

FAMILY D

Audit Evidence Engine

Automated, tamper-evident compliance evidence generation.

FAMILY E

CyGScrypt DSL / Compiler

QuantaScript declarative language + compiler for crypto policy.

FAMILY F

Threshold ML-DSA Composite Signing

Threshold signatures over composite ML-DSA schemes.

FAMILY G

PQC-Readiness Observability

RMM/MDM-integrated PQC-readiness telemetry.

FAMILY H

Compile-Time Mosca Risk Band

Mosca-inequality risk banding at compile time.

FAMILY I

PKE-to-PKI Drift Gate

Drift gating across the PKE↔PKI boundary.

FAMILY J

PQC-Signed PKCE Token Exchange

Post-quantum-signed OAuth PKCE token exchange.

FAMILY K

mathsecurity.json Attestation

Lattice-parameter attestation manifest format.

FAMILY L

CMMC Evidence Auto-Gen

CMMC evidence auto-generated from PKI telemetry.

FAMILY M

Declarative CA Topology Graph

Declarative modeling of certificate-authority topology.

TRADEMARK

VSP — Verified Self-Propulsion

Coined brand IP; file as trademark alongside the patent portfolio.

Products & standards: Mechanism II (crypto telemetry engine), CYGNUS / sanctum-quanta (composite PQC ML-DSA + ML-KEM), QuantaScript DSL, Sanctum Agent, and the MCP layer — aligned to FIPS 203/204/205 and IANA OID 1.3.6.1.5.5.7.6.41. ORCID 0009-0006-6395-5308.
05 · Revenue Stream Diversification

Five operating layers + a wealth engine

Recurring managed-security revenue is compounded by a franchise-licensing override, technology licensing, hardware margin, and third-party IP royalties — then diversified into index, real-asset, and venture allocations.

LAYER 1

OpCo Direct MRR

Sanctum SecOps OpCo managed-security recurring revenue from its own client base.

LAYER 2

13-Family Override

15–20% licensing override on each of 13 authorized sub-licensee MRR bases (declining tiered).

LAYER 3

Technology Licensing

Composites / Cygnus toolkit licensed flat + per-seat to all entities and third parties.

LAYER 4

Silicon Hardware Margin

PQ-ready HSM firmware, hardware root-of-trust, and appliance resale margin.

LAYER 5

IP Royalty Stream

Third-party (non-family) MSSP licensees; IETF RFC adoption → OEM royalties $500K–$5M/yr each.

WEALTH ENGINE

Diversified Allocation

Capital LLC 3-fund index, I-Bond ladder, REITs; Real Assets LLC property; Ventures LLC co-investments; DR SRL LatAm real estate (8–12% yield).

5.1DoD-first vertical fanout

PhaseActionLeverage created
1Win DoD SBIR/STTR or direct award via SAM.govNon-dilutive capital + proof of concept
2DIBNet listing + CMMC RPO designationInbound from 300K+ DIB contractors
3Vertical fanout: Army → Navy → USAF → SOCOM → ICEach branch = new contract vehicle
4Prime sub-licensing: Raytheon, L3Harris, SAIC, LeidosPer-seat volume at enterprise margin
5LatAm via DR SRL (IDB-funded deployments)650M+ Spanish-speaking market
06 · Five-Year Deployment Plan

Sequenced implementation roadmap

Formation sequence: Trust → BVI HoldCo → IP assignment → operating entities → licensing network → citizenship → EU entity → scale.

Mo 1–3

Phase 1 — Foundation · est. $85K–$120K

  • Engage international structuring counsel (US + BVI + DR)
  • Form South Dakota Perpetual Dynasty Trust
  • Incorporate Sanctum International Holdings Ltd (BVI)
  • Redomicile OpCo to Delaware; form Composites & Silicon LLCs
  • Execute IP assignment (IRC §482) + inter-company license
  • Deploy $200K Dominican Republic investment vehicle
Mo 3–12

Phase 2 — DR Residency & Licensing Network · est. $60K–$90K

  • File DR investment residence (Decree 950-01)
  • Draft Master Franchise / Sub-License Agreement
  • Onboard first 3–5 family licensees; then remaining 8–10
  • Begin SOC 2 Type II readiness + CMMC Level 2 process
Mo 6–24

Phase 3 — DR Citizenship & Spain Residency

  • Establish DR physical presence (6 months)
  • Apply for DR naturalization (Law 1683) → receive passport
  • Establish Spanish residency (Digital Nomad / Self-Employment visa)
  • Begin 24-month Spain residency clock
Yr 2–3

Phase 4 — EU Entity & ENISA Certification

  • Incorporate Sanctum Europe SL (Spain)
  • EU banking (Santander / BBVA / Deutsche Bank)
  • Begin ENISA MSS certification; Horizon Europe PQC grants
Yr 3–5

Phase 5 — Scale & Optimization

  • Evaluate Cayman flip for institutional capital raise
  • Expand network to 25–30 authorized licensees
  • International sub-licensees (Canada, UK, EU)
  • Target $20M+ ARR for institutional PE/growth-equity raise
07 · Live Execution Pipeline

Current GitHub & IETF status

Open items in Sanc-Admin/unified — strategic (#22–28), technical (#16–20, production-blocking), and legal (#21). Fix blocking technical debt before any live DoD demo.

7.1Strategic issues

#28
Master Audit + Net-Worth ProjectionsCritical

Consolidated trust/DoD audit and follow-ups.

#27
TED Talk TrackerHigh

Hold as leverage — deliver post-DoD contract + IETF WG adoption.

#26
DR Action PlanHigh

Apostille documentation; citizenship timeline.

#25
Dual Citizenship LayerCritical

DR → Spain/EU three-passport path.

#24
Pilot 100 Outreach PlanCritical

LinkedIn 500 campaign + first 20 demo calls.

#23
Family Trust DiversificationCritical

Capital / Real Assets / Ventures / DR SRL structure.

#22
VSP Revenue Pathways MasterCritical

Five-layer revenue model + VSP monetization.

7.2Technical debt — production-blocking

#20
HQC/FN-DSA providers stubbed without liboqsBlocking PQC claims

Highest-risk debt — will fail in a live DoD demo. One CI command.

#16
QuantaScript wire types diverged from PKI-stackBlocking demo

Silent break at the contract boundary.

#17
Shared-models Merkle/OID divergenceCompliance evidence risk

Two divergent implementations invalidate evidence.

#19
Merkle implementation duplicationDrift risk

Establish a single source of truth.

#18
MANIFEST repos not in SANCTUM_UNIFIED_RDCoverage gap

14 repos not cross-referenced for patent-discovery evidence.

7.3Legal — not started

#21
Entity formation sequenceBlocked

Needs DoD-experienced business attorney + ITAR/export-control review of PQC IP before any DoD contract execution.

Companion deliverable: the DoD Phase-1 public landing site (CMMC 2.0 & PQC readiness, Falcon-Level assessment funnel) is deployed and live at sanctum-dod.vercel.app. This dossier and that public site form the two halves of the current launch.