Uplink & rental
We rent the satellite. We upload the ledger.
A SovereignSky node is a 10-watt, 1.5U, 1.2-kilogram software payload — small enough that hosting it is a catalogue purchase rather than a spacecraft programme. This page states what that rented capacity costs and exactly how the blockchain gets up there, in stages, over ordinary ground-station passes.
What we are actually renting
Three products, all of them already on sale.
None of these require us to own a spacecraft. Each is bought from operators who publish an interface document and a price.
Software slot on a satellite already in orbit
$0.2M – $0.6M one-off
Spire Space as a Service, D-Orbit ION
We buy a compute slot and upload flight software. No bus to build, no launch to purchase, no hardware qualification campaign. This is the cheapest credible node and the natural way to re-fly the 2020 in-orbit signature with post-quantum signing.
Cheapest first node
Hosted module on a partner bus
$1.0M – $2.5M fixed price per module
Loft Orbital Hub, EnduroSat 6U/16U, NanoAvionics
Our node ships as a qualified 1.5U module against a published interface document and the mission manager integrates, launches on rideshare and operates it. Higher price, materially lower execution risk, and permanent capacity rather than a finite demonstration.
Permanent capacity
Bought pass time on the ground
$0.3M – $0.8M / year for the whole cluster
Commercial ground-station-as-a-service networks
Each satellite moves about 250 MB a day, which is roughly 17 minutes of contact at 2 Mbps S-band — spread over four to six short passes for latency, not for volume. We lease that pass time by the minute. No teleport is built.
Operating cost
What one node asks of a host
The margin is the commercial point: we are a small, quiet, low-risk tenant on hardware sized for far hungrier payloads.
- Power
- 10 W orbit-average, 18 W peak
- Host buses publish 10–60 W of average payload power
- Volume
- ≈ 1.5U (100 × 100 × 150 mm)
- Host buses offer 6U–16U payload envelopes
- Mass
- ≈ 1.2 kg
- Host buses carry 7–24 kg of payload
- Data
- ≈ 250 MB / day
- S-band at 2 Mbps; 16U buses publish up to 1 Gbps
- Storage
- 256 GB rad-tolerant NAND
- One module, inside a single 1U slice
What the rent costs
Rental cost by configuration.
The same four configurations as the capacity page, priced as rent rather than as construction. One-off figures buy the slot or the hosted module; annual figures are pass time and mission operations.
| Configuration | What we rent | Indicative cost | What it buys |
|---|---|---|---|
| 1 node — demonstration | 1 rented software slot | $0.2M – $0.6M one-off | Proves the node in orbit. No launch, no hardware, no constellation. |
| 4 nodes — fault-tolerant quorum | 4 rented slots across 2 operators | $1.0M – $2.2M + ≈ $0.3M / yr | Survives the loss of one node. Enough to sell notarisation with an orbital witness. |
| 8 nodes — equatorial anchor cluster | 4 rented slots + 4 hosted modules on 8 independent buses | $6M – $12M + ≈ $0.6M / yr | The target configuration: survives two simultaneous failures, 12–16 contacts a day over the tropics. |
| 24–35 nodes — continuous coverage | Dedicated and shared satellites, replenished from an equatorial range | $30M+ | Only funded once traffic and sovereign contracts prove ownership beats renting. |
Against roughly $1.0M a year of orbital operating cost, the eight-node cluster anchors 8,640 checkpoints a day — a fraction of a cent per anchor, and each anchor covers up to 50,000 transactions.
The key insight
The archive never goes to orbit. Only the anchors do.
The unpruned chain grows around 100 GB a day and stays in SuperFile Cloud. Orbit carries a checkpoint chain of about 12.6 GB a year — which is why it can be uploaded a pass at a time.
How the upload works
Six stages, none of them a single big transfer.
Each stage is verifiable on its own and resumable if a contact is lost. Nothing executes until it has been checked against a signature we control.
00
Stage 0 — Qualify on the ground
Weeks, before anything fliesPlannedThe node is built and tested against the host operator's published payload interface: power draw, thermal path, data rates, command dictionary. Nothing is uploaded until the ground twin passes the same test suite the flight article will run.
01
Stage 1 — Bootstrap image
Tens of megabytes, a few passesPlannedKernel, verifier and public keys go up as a signed image split into chunks sized to a single contact. Each chunk carries its own hash; the node assembles and verifies the whole image before it ever executes it.
02
Stage 2 — Checkpoint headers, not history
≈ 12.6 GB per year of anchors, chunked per passPlannedThe node syncs the pruned checkpoint chain — headers, Merkle roots and aggregate signatures at roughly 4 kB every ten seconds. It verifies the chain from anchors instead of replaying full history, so there is no bulk archive transfer to orbit at any point.
03
Stage 3 — Cache fills forward from live traffic
≈ 35 MB / day of chain statePlannedThe rolling seven-day transaction cache is not uploaded. It accumulates from live traffic as the node runs, reaching its steady state of about 45 GB in a week of normal operation.
04
Stage 4 — Join consensus
Read-only witness first, then signerPlannedOnce the node's state hash matches the quorum it is promoted from observer to signing member. A node that disagrees is simply never promoted, so a bad upload cannot corrupt the ledger.
05
Stage 5 — Signed deltas thereafter
Ongoing, smallPlannedUpdates are signed delta packages, each independently verifiable, applied to an inactive partition with automatic rollback to the last good image. This is how hosted-payload operators already ship flight-software updates.
Why partial upload is safe
Chunked, signed, resumable, reversible.
The archive never goes to orbit
The unpruned chain grows around 100 GB a day at design throughput and lives in SuperFile Cloud across sovereign terrestrial regions. Orbit carries checkpoints — kilobytes, not terabytes.
A failed pass resumes, it does not restart
Every chunk is content-addressed, so a dropped contact costs the remainder of one pass. There is no single monolithic transfer to lose.
Nothing executes unverified
Images and deltas are signed. The node refuses code it cannot verify and reverts to the last good partition, so a corrupted uplink is a non-event rather than a lost satellite.
The host cannot alter state
Signing keys never leave our custody. A host operator supplies power, thermal control and a radio; the worst it can do is deny service, which is exactly why nodes sit on independent buses across multiple operators.
What we do not claim
The honest limits of these numbers.
An investor should be able to see the caveats stated in our own words.
Prices are indicative
Every figure here is built from public supplier datasheets and product pages current in 2026. They are planning estimates for the capital plan, not quotations.
No hosting agreement is signed
Except the SpaceQuest relationship behind the 2020 in-orbit signature, the operators named are suppliers we intend to buy from on commercial terms.
Upload windows assume nominal passes
Stage durations assume normal contact schedules from a commercial ground network. Weather, host priorities and licensing can extend them; none of it changes the cost structure.
Investor FAQ
The questions this page gets asked.
How long from a rented slot to a fully synced node?
Days, not months. The bootstrap image is tens of megabytes and the checkpoint chain is the only historical data that moves — about 12.6 GB per year of anchors, against roughly 17 minutes of contact a day per satellite at 2 Mbps. The seven-day transaction cache then fills forward from live traffic, so the node is signing within a week of first contact.
Why can the ledger be uploaded in parts at all?
Because the orbital node keeps a self-verifying checkpoint chain rather than a full archive. Each checkpoint is a header, a Merkle root and an aggregate signature, so state can be transferred in arbitrarily small verified pieces and reassembled — the node proves the chain cryptographically instead of trusting the order of delivery.
What happens if a host satellite fails or deorbits mid-programme?
We re-provision the node onto another slot and it re-syncs from the quorum. Because the node is specified against a power and volume envelope rather than one vendor's bus, and because the checkpoint chain is small, losing a host costs a rental, not the network.
Can a node move between operators?
Yes. The node is a bounded software workload against a documented payload interface. Multiple qualified suppliers meet the same 10 W / 1.5U envelope, which is what keeps this a competitive purchase rather than a sole-source dependency.
Who owns the software once it is in orbit?
We do, along with the keys. Hosted-payload contracts separate the payload from the platform: the operator provides power, thermal control, a radio and an uplink path, and does not gain rights to the payload or its data.
Is renting really cheaper than owning?
For the first four phases, by roughly an order of magnitude. A dedicated small-satellite programme with its own bus, launch and ground segment has historically cost $10M or more per spacecraft. Ownership only enters the plan once traffic and sovereign contracts prove the unit economics.