Pilot Termination & Data Return Protocol

1 · Why this protocol exists

Every DEFONEOS pilot reaches Day 90 with one of three outcomes:

1. Award: buyer signs the MSA + 12-month contract; pilot transitions to production.
2. Transition: buyer chooses a different vendor; DEFONEOS returns all buyer artefacts and deletes pilot-specific data.
3. Terminate without follow-on: buyer ends the pilot with no contract; same data return + deletion.

Outcomes (2) and (3) require a precise, auditable closeout. The buyer needs assurance that:

• All their data is returned in a portable, documented format.
• All pilot-specific model weights / adapters / preferences are deleted.
• All inference logs are deleted.
• The deletion is verified, SIGIL-anchored, and BFT-council-approved.
• If Sovereign / Sovereign-Air-Gap tier, source code + weights in escrow are verified.
• 30 days of read-only post-pilot support is available to the buyer.

This protocol is the contractual reference. It is invoked automatically on any pilot termination event; the 12 steps run sequentially with named owners and 24-hour SLAs per step.

2 · The 12-step Day-90 closeout sequence

Total elapsed time: 5 business days. Each step has a named owner, a 24-hour SLA, and a SIGIL-anchored output. The 33-agent BFT council signs the final closeout (§9).

3 · The 6 buyer artefacts returned

All artefacts are returned via signed URL (24h expiry, 1 re-download max). Each artefact is SHA-256 hashed and SIGIL-signed. The buyer verifies any artefact via csoai.org/artefact/verify/{artefact_id}.

4 · The deletion chain (steps 6-9)

Steps 6-9 are the data deletion chain. Each step produces an empty-volume attestation:

{
  "deletion_id": "DEL-2026-07-14-MEGACORP",
  "tenant_id": "megacorp-pilot",
  "step": 6,
  "category": "inference_logs",
  "regions_deleted": ["uk-south-1", "eu-west-1"],
  "volume_before_bytes": 536870912,
  "volume_after_bytes": 0,
  "method": "secure_erase_crypto_shred",
  "verification": "sha256('') = e3b0c44...",
  "executed_at": "2026-07-14T15:00:00Z",
  "executed_by": "SRE-on-call (named)",
  "witnessed_by": "Buyer DPO (optional)",
  "ed25519_sig": "..."
}

Steps 6, 7, 8 each produce one of these. Step 9 is the BFT council verification vote (≥23/33 quorum required to approve deletion).

5 · Escrow verification (Sovereign tiers only)

For Sovereign / Sovereign-Air-Gap pilots, step 10 verifies that the buyer's source code + weights remain in escrow:

1. NCC Group (UK escrow agent) confirms deposit integrity via SHA-256 hash check.
2. NCC Group confirms the canary release test passes.
3. DEFONEOS provides a SIGIL-anchored escrow verification receipt to buyer.
4. Buyer may (with NCC Group's permission) attend the verification.

If verification fails, DEFONEOS has 5 business days to remediate. Failure to remediate triggers buyer rights under the escrow agreement (release of source code + weights to buyer).

6 · The 30-day post-pilot support window

After closeout (§12), buyer has 30 days of read-only access to:

• All 6 returned artefacts (re-download via signed URL, max 3 attempts)
• Email support (24h response, business hours)
• 1 hour of named-TAM consultation (Platinum / Sovereign only)
• The post-pilot report walkthrough call (60 min, with VP Customer Success)

No new inference, no new data, no new training. Read-only. After 30 days, the buyer-side tenant is permanently archived (read-only, no support) for 7 years (HMRC retention), then permanently deleted.

7 · The 90-day renewal window

After termination (any outcome except award), the buyer has 90 days to invoke the renewal window:

• Sign the production MSA at the preferred-vendor pricing (last quoted before termination)
• Re-deploy within 30 days of MSA signature (data retention preserved if same tenant ID)
• Pilot artefacts retained and re-used (with buyer consent)

After 90 days, preferred-vendor pricing expires and the buyer must re-quote.

8 · BFT council audit closeout (the §9 vote)

The 33-agent BFT council votes on the closeout at step 9. The vote confirms:

1. All buyer data deleted (steps 6, 7, 8 verified)
2. All pilot-specific weights / adapters deleted
3. Buyer artefact pack delivered (step 5 verified)
4. SLA performance during pilot attested (§7 above)
5. No outstanding buyer disputes

The vote requires ≥23/33 quorum. If approved, the council signs a single SIGIL-anchored closeout certificate. If rejected, closeout pauses until the rejection reason is remediated.

9 · Edge cases (the 5 named scenarios)

10 · Cross-walk to existing DEFONEOS artefacts

11 · The 5 Anti-Patterns (Pilot Closeout Disasters We Refuse)

1. No "we'll get to it next quarter." Closeout is 5 business days. No extensions without BFT vote.
2. No "we keep data for analytics." Pilot data is deleted at closeout, period. Re-deployment requires new consent.
3. No "buyer can't verify deletion." Empty-volume attestation + SIGIL receipt + optional DPO witnessing.
4. No "escrow is symbolic." Escrow verification is mandatory at closeout for Sovereign tiers.
5. No "no BFT vote." §9 vote is mandatory; no closeout without 23/33 quorum.

12 · Buyer Next Steps

1. Verify this protocol hash: curl https://csoai.org/defoneos-mod-pilot-termination-data-return-protocol.html | shasum -a 256
2. Browse a sample closeout report: csoai.org/closeout/sample/{tenant_id}
3. Verify any deletion attestation: csoai.org/deletion/verify/{deletion_id}
4. Subscribe to closeout-related advisories: csoai.org/advisories/subscribe
5. Schedule a 60-minute closeout walkthrough with our VP Customer Success.
6. Inspect the post-pilot report template: csoai.org/closeout/template.md