For Canadian public sector
The agentic SOC that keeps Canadian data in Canada.
Morpheus is the accountable agentic SOC platform from D3 Security, a 100% Canadian company with Canadian hosting. It investigates every alert to L2 depth, grades every verdict by its evidence, keeps a human in oversight of every AI decision, and puts every incident on one record your auditor can read. Built for federal departments, provincial ministries, crown corporations, municipalities and the transit and utility authorities that keep the country running.
Available in English and French. Support from a Canadian team, in Canadian time zones.
The situation
Your SOC serves Canadians.
Whether that’s a federal department, a provincial ministry, a health authority, a crown corporation, a city, or the transit system that moves a million people a day, the shape of the problem is the same: a small team, a big mandate, a stack that took years to assemble, and a public that expects you to have seen everything.
Two questions come before any other in a Canadian public-sector evaluation. Where does the data live, and who can be compelled to hand it over? Morpheus answers both the same way: in Canada, and nobody outside it.
Data sovereignty
Where does the data live, and who can be compelled to hand it over?
In Canada, under a Canadian company. D3 Security is headquartered in Vancouver, Canadian-owned, with Canadian hosting. There is no foreign parent whose legal obligations follow your telemetry across a border.
Canadian-hosted
Morpheus runs in Canadian cloud regions for SaaS customers. Telemetry, investigation artifacts and audit records stay in the country. On-premises, hybrid and fully air-gapped deployments are available where the classification of the environment requires it, with AI inference inside your own infrastructure.
Canadian-owned
D3 Security is a 100% Canadian company. The people who build, host and support Morpheus are subject to Canadian law and no other. When procurement asks where the vendor is headquartered and where the data sits, the answer is the same word twice.
Canadian-supported
Migration architects, customer success and support in Canadian time zones, in English and French. Your on-call analyst at 03:00 Pacific is not waiting for a support desk to open in another hemisphere.
This is a structural fact about the company, not a hosting option that can change at the next renewal. For the public-sector buyer it removes a question that otherwise follows a foreign vendor through every privacy impact assessment and every legislative committee.
Coverage
Can a small team actually get to every alert?
With Morpheus, yes. Every alert receives an L2-depth investigation before an analyst opens it, up to 95% in under two minutes per customer-reported production data, July 2026, and every finding is graded by its evidence. When Morpheus is uncertain, it defers to a human.
Public-sector SOCs rarely lack tools. They lack the hours to run the investigation each alert deserves, and the alerts that age out of the queue are where dwell time lives. Morpheus removes the decision about which alerts deserve attention by giving all of them the same one: cross-tool correlation, attack-path tracing, blast radius, drafted response. Six analysts covering 22,000 employees is a real ratio in Canadian government. It stops being a coverage problem when the investigation is already done.
Confirmed
The source telemetry is attached. Your analyst, and your auditor, can read what Morpheus saw.
Inferred
The reasoning is shown. The evidence is circumstantial, and Morpheus says so.
Gap
Morpheus looked, found nothing, and reports the gap instead of filling it.
24/7 coverage, and nobody has to work nights
A regional transit authority runs a day shift and an on-call rotation. At 02:40 an identity alert fires: a fare-system service account authenticating from an unexpected network. Morpheus correlates the login against the endpoint, the VPN log and the account’s 90-day history, grades the finding Confirmed, and pages the on-call lead with the evidence attached and containment drafted. At 03:15 a similar alert grades Gap: the source resolves to a known maintenance depot. Nobody is woken. Both cases are on the record in the morning, in the same format, ready for the next audit.
Oversight
Does the AI decide, or do we?
You do, at the level you choose, per case type. Morpheus investigates and drafts; response runs on deterministic playbooks with hard guardrails; the autonomy mode decides how much happens before a human signs.
Deterministic
Human writes the rules
Rule-based playbooks run end to end. No AI in the chain.
AI-Assisted
Human in every action
Morpheus investigates and recommends. Your analyst approves every step.
AI-Led
Human at sign-off
Morpheus investigates and drafts the response. You sign off; response runs.
Autonomous
Human at design time
Investigation and response at AI speed. Gates set at design time. Roll back any action.
Public institutions are held to a higher standard of explanation than private ones. Every mode change, override, approval and pause is logged with the analyst’s identity on the incident record, in the same format across all four modes, so the answer to “who decided, and on what basis” is a record rather than a reconstruction. That serves an internal audit, an Auditor General’s office, a privacy commissioner, and a records request equally well.
Where it fits
Federal, provincial, municipal. Same platform, different fit.
Federal departments and agencies
Deployment options that fit environments governed by ITSG-33 control profiles and Canadian Centre for Cyber Security guidance, including on-premises and air-gapped where classification requires it. One record per incident for departmental security officers and the oversight that follows a federal breach. Positioned for the obligations federal critical-cyber-systems legislation places on designated operators.
Provincial ministries, health authorities and crown corporations
Provincial privacy statutes carry residency expectations that a Canadian-hosted platform meets without exception clauses. Multi-tenant by design, so a shared-services SOC can serve ministries, agencies and health regions as separate tenants with separate autonomy settings and one operations team.
Municipalities, transit and utilities
Cities, regional districts, transit authorities, water and power utilities and police services boards run some of the most exposed operational technology in the country on some of the smallest security teams. Morpheus connects to the stack you already have, covers the overnight without a night shift, and works equally well run by your own team or by the MSSP you contract.
Working with your MSSP
Many Canadian public bodies run their SOC through a managed provider. Morpheus sets autonomy and residency per tenant and produces the same incident record for every client, so the evidence your auditor asks for is the record your provider already holds. Morpheus for security service providers
Your stack stays put
Sentinel, Splunk, QRadar, Defender, CrowdStrike, SentinelOne, Okta, Entra, ServiceNow, Jira and 800 more, through integrations that repair themselves when a vendor changes an API. Nothing in your environment has to be replaced to start.
Procurement
Will this still be the right choice in five years?
The question every public-sector procurement is really asking. Four answers.
Canadian for good
D3 Security was founded in Vancouver and is 100% Canadian-owned. The sovereignty answer on this page is a property of the company, not a configuration.
Built for scale, already
The architecture under Morpheus carries a $10B+ global financial services firm and a global MDR provider’s 1,000+ customer tenants. It runs a 22,000-employee organisation and a six-person team on the same engine.
No lock-in
Morpheus sits on top of the SIEM, EDR and ticketing you already run, so changing any of them is a connector change. Playbooks, cases and evidence export in standard formats. Autonomy is reversible per case type.
Pricing a public budget can plan around
Annual subscription sized to your alert volume envelope, AI included. No token costs, no usage meter, no compute surprise in a bad month. Overage per alert is published in advance. Ask us about current federal and provincial procurement vehicles.
Guide, Canadian public sector
Where Does Your Alert Data Go? Data sovereignty, AI oversight and a twelve-question vendor checklist, written to be forwarded to your privacy officer and procurement lead. Get the guide
faqs
Questions Canadian public-sector teams ask us
Where is our data hosted?
In Canada. SaaS deployments run in Canadian cloud regions, and telemetry, investigation artifacts and audit records stay in the country. On-premises, hybrid and air-gapped deployments are available where the environment requires it, with AI inference inside your own infrastructure for air-gapped installations.
Is D3 Security a Canadian company?
Yes. D3 Security is headquartered in Vancouver, British Columbia, and is 100% Canadian-owned, with Canadian hosting and a Canadian support team. There is no foreign parent company.
Can we run workflows with no AI involved at all?
Yes. Deterministic mode runs rule-based playbooks end to end with no AI in the chain and no inference invoked. It is set per case type, so sensitive workflows can stay fully deterministic while other alert types run at higher autonomy on the same platform, with the same record format.
How does Morpheus support ITSG-33 and Cyber Centre guidance?
By producing the evidence those frameworks ask for: one record per incident showing what was detected, investigated, found and done, by whom, under which autonomy mode, with source evidence attached to every finding. Deployment options include on-premises and air-gapped for environments where the control profile requires it. D3 provides control-mapping documentation on request.
Can a shared-services SOC serve multiple ministries or agencies?
Yes. Morpheus is multi-tenant by design. Each ministry, agency or health region can be a separate tenant with its own data partition, autonomy settings and audit trail, operated by one central team, with role-based access so each organisation sees only its own tenant.
We’re a municipality or transit authority with a very small team. Is this for us?
Yes. Morpheus is built so the investigation is done before your analyst opens the alert, which is what lets a small team cover a large environment around the clock. It connects to the tools you already run, and it works equally well operated by your own staff or by the managed provider you contract.
Is Morpheus available in French?
Yes. Sales, onboarding and support are available in English and French. Ask about French-language product documentation for your deployment.
How is Morpheus priced?
Annual subscription, sized by your alert volume envelope. The AI is included: no token costs, no usage meter. Above the envelope, additional alerts are priced per alert, published in advance. Ask us about current federal and provincial procurement vehicles.
D3 Security builds Morpheus, the accountable agentic SOC platform. Vancouver, Canada. 100% Canadian company and hosting. References to legislation and control frameworks are provided for information and do not constitute legal advice.