Statement of Work — 90-Day Sovereign AI Pilot

1. PARTIES

2. DEFINITIONS

3. SCOPE OF WORK

3.1 Deliverable D1 — Sovereign Platform Deployment

3.2 Deliverable D2 — DEFONEOS-SEAL Pilot Credential

3.3 Deliverable D3 — 33-Agent BFT Council Training

3.4 Deliverable D4 — JSP 936 / NIST AI RMF Compliance Module v0.1

4. MILESTONES & PAYMENT SCHEDULE

5. ACCEPTANCE PROCEDURE

1. Supplier delivers milestone by due date.
2. Within 5 Working Days, Buyer either: (a) signs Acceptance Certificate, OR (b) issues written rejection with specific defects.
3. If rejected, Supplier has 10 Working Days to remediate at no extra cost. Buyer then has 5 further Working Days to accept or reject again.
4. If rejected twice, dispute resolution per § 11.

6. SERVICE LEVEL AGREEMENTS (SLAs)

Uptime target: 99% measured monthly, excluding scheduled maintenance (48h written notice, max 4h/month). SLA breach credits: 5% of monthly fee per percentage point below 99%, capped at 25% of monthly fee.

7. DATA PROTECTION & DATA RESIDENCY

1. UK GDPR + Data Protection Act 2018 apply. Both parties are independent data controllers (no joint controllership without separate DPA).
2. Data residency: All Buyer data stays in UK data centres or AUKUS-compatible jurisdictions (US, Canada, Australia, New Zealand). No transfers to non-AUKUS jurisdictions without prior written consent.
3. Sub-processors: Supplier uses no third-party sub-processors for Buyer data without prior written approval. Disclosure list in Annex A.
4. Personal data minimisation: Supplier processes only the data strictly required for the deliverables. No telemetry, no analytics, no model training on Buyer data.
5. Breach notification: Supplier notifies Buyer within 24h of becoming aware of any actual or suspected personal data breach.
6. Audit right: Buyer may audit Supplier's data handling on 14 days' notice, max once per 12-month period, at Buyer's cost.

8. INTELLECTUAL PROPERTY

9. CONFIDENTIALITY

1. Each party treats the other's Confidential Information as strictly confidential for 5 years post-Pilot.
2. Standard exceptions: public domain, already known, independently developed, legally compelled disclosure (with notice).
3. Supplier may reference Buyer's logo + "DEFONEOS-SEAL issued to [Buyer]" publicly unless Buyer objects in writing within 14 days of SEAL issuance.

10. WARRANTIES

1. Sovereign warranty: Sovereign Substrate contains no malicious code, no undisclosed network calls, no undisclosed third-party dependencies. Open-source verification. Buyer may scan at any time.
2. IP warranty: Supplier owns or has right to use all IP in the Sovereign Substrate. No third-party infringement claims known.
3. Capability warranty: Supplier has the technical capability to deliver the 4 deliverables. References: open-source codebase (200+ PyPI downloads / 30+ GitHub forks / verifiable contributor count).
4. Compliance warranty: DEFONEOS-SEAL audit process is independent (33-agent BFT, no single agent controls >7% of vote weight).

11. LIMITATION OF LIABILITY

1. Cap: Total aggregate liability of either party is capped at the greater of (a) the total fees paid in the 12 months preceding the claim, or (b) £250,000.
2. Excluded damages: Neither party is liable for indirect, consequential, loss-of-profit, loss-of-data damages. Standard carve-outs.
3. Unlimited liability: For (a) breach of confidentiality, (b) breach of data protection, (c) IP infringement, (d) fraud, (e) death/personal injury.
4. Mutual indemnity: Each party indemnifies the other against third-party claims arising from its own breach.

12. SECURITY CLEARANCE & PERSONNEL

1. Supplier's project lead (Nicholas Templeman) holds [or is applying for] UK SC clearance. Application submitted [date]. Estimated issue: 4–6 weeks from contract signature.
2. Until SC issued, work proceeds on OFFICIAL-only data. SENSITIVE workstreams deferred.
3. All Supplier personnel handling Buyer data are BPSS-checked (Baseline Personnel Security Standard) as minimum.
4. Substitution of key personnel requires Buyer's written approval (not to be unreasonably withheld).

13. TERM, TERMINATION & EXIT

1. Term: 90 days from Effective Date + 30-day M04 review window = total 120 days.
2. Termination for convenience by Buyer: 14 days' written notice. Supplier entitled to fees for work done + 20% of remaining milestone value as cancellation fee.
3. Termination for cause: Either party on 14 days' written notice for material breach not remedied within that period.
4. Termination for insolvency: Immediate on insolvency event.
5. Exit assistance: Supplier provides 30 days' post-termination exit assistance: full data export in OSCAL + JSON + PDF, knowledge transfer sessions, source-code escrow key release.

14. DISPUTE RESOLUTION

1. Good-faith negotiation: 14 days.
2. Mediation: CEDR (Centre for Effective Dispute Resolution) London, 30 days.
3. Litigation: English courts, exclusive jurisdiction. (Or arbitration under LCIA rules if Buyer prefers — option to switch at signing.)

15. GENERAL

1. Governing law: Laws of England & Wales.
2. Notices: Email to addresses in § 1 suffices, with read-receipt requested.
3. Assignment: Neither party may assign without consent, except Supplier may assign to a successor entity.
4. Entire agreement: This SoW + Annexes + Order Form constitute the entire agreement.
5. Amendments: Only by written deed signed by both parties.
6. No partnership: Nothing creates a partnership, joint venture, or employment relationship.
7. Counterparts: May execute in counterparts, including DocuSign / Adobe Sign.

16. ANNEX A — SUB-PROCESSORS

17. ANNEX B — DEFONEOS TRUST EVIDENCE

• 200+ PyPI package downloads of meok-defoneos-* packages (publicly verifiable).
• 30+ GitHub forks of substrate components (publicly verifiable).
• 240-test pytest suite passing in CI (publicly verifiable).
• OSCAL SSP auto-generator output: machine-readable compliance proof.
• 33-agent BFT council votes: publicly verifiable on Solana memo + signed JSON.
• SHA-512 audit trail of all Substrate releases (publicly verifiable).

18. SIGNATURE BLOCK

19. INVOICE & PAYMENT DETAILS

20. HONESTY REGISTER — What This SoW Does NOT Claim

1. This SoW assumes MEOK Labs Ltd exists, is UK-incorporated, and VAT-registered. UK Company No. 16939677 must be verifiable at companieshouse.gov.uk. If the company is not yet struck off the register or struck off, this SoW is invalid.
2. SC clearance is not yet held. § 12 says "applying for" or "pending." Until SC issued, work on OFFICIAL data only. Realistic issue: 6-12 weeks from submission. Don't promise SENSITIVE work pre-SC.
3. The DEFONEOS-SEAL is open and not Mod-awarded. It is an industry self-credential. Not a replacement for Def Stan 05-138 / JSP 936 / ISO 9001 / Cyber Essentials Plus. Buyers may use it as adjunct evidence, not as primary accreditation.
4. Pricing is appropriate for SME/Scaleup. Not for £Bn primes. £264k 90-day pilot is below UK MOD Procurement Policy Note 06/20 threshold for single-tender justification (currently £250k for goods/services — verify at time of bid). For larger primes expecting £1M+ deployments, this is a starter engagement only.
5. 33-agent BFT council is a credential mechanism, not a legal entity. It issues a cryptographic attestation. It does NOT confer legal warranties, regulatory approval, or third-party validation. The legal warranty comes from MEOK Labs Ltd as corporate entity.
6. This SoW is for a 90-day PILOT. Not a 3-year contract. The "3-yr option" at M04 is a forward offer, not a guarantee. Buyer may walk away after M04 with no further obligation (retention released).
7. Uptime SLA 99% is realistic for sovereign infrastructure, not hyperscaler 99.99%. 99.99% is achievable ONLY with multi-region failover, which costs 5-10× more. If Buyer's mission requires 99.99%, additional 50% infrastructure uplift fee applies.
8. JEEVES is the in-product AI assistant, not the corporate signatory. This document was DRAFTED by JEEVES but the LEGAL SIGNATORY is Nicholas Templeman as Director of MEOK Labs Ltd. JEEVES has no legal standing.